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ABSTRACT 

This  thesis  examines  the  increase  in  reliability 
of  a  thermal  power  control  system  by  using  redundant 
temperature  and  pressure  instrumentation.   This 
improvement  in  reliability  can  be  accomplished  by 
applying  various  multiplexing  techniques  to  the  noisy 
signals  from  a  set  of  redundant  instrument  channels. 
Multiplexing  techniques  such  as  averaging,  mediating, 
and  voting  based  on  weight  factors  will  be  examined 
in  detail  along  with  probabilistic  analysis  and 
experimental  verifications.   The  effect  of  multiplexing 
on  noise  reduction  will  also  be  discussed.   And  finally, 
the  area  of  instrument  error  distribution  within  a 
real-time  system  is  briefly  introduced  to  provide  basis 
for  future  work. 
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PREFACE 


An  often  utilized  technique  to  increase  the  reliability 
in  any  control  system  is  the  use  of  redundancy.   The  art  of 
redundancy,  however,  comes  in  many  variations.   It  could 
be  redundancy  in  the  software,  like  a  back-up  computer 
program  package  in  an  interplanetary  spacecraft;  or  it  could 
be  redundancy  in  the  hardware,  like  a  set  of  triply  redun- 
dant signal  processing  channels,  as  is  the  case  in  this  thesis. 

A  system  that  uses  redundancy  to  increase  its  overall 
reliability  is  sometimes  referred  to  as  "a  fault-tolerant 
system".   Fault-tolerance  is  the  unique  attribute  of  a  control 
system  which  makes  it  possible  for  the  system  to  continue  with 
its  program-specified  behavior  as  a  logic  machine  after  the 
occurrence  of  faults. 

One  area  of  engineering  that  the  application  of  redundancy 
has  been  mostly  neglected  is  the  redundancy  of  primary  instru- 
mentation in  a  thermal  power  system.   Without  redundancy, 
if  the  one  and  only  instrument  fails,  the  entire  control  system 
will  more  than  likely  malfunction.   One  must  recognize  the 
tremendous  amount  of  revenue  at  stake  when  a  power  plant  is 
shutdown  due  to  a  simple  instrument  failure. 

In  this  thesis  the  author  will  first  present  an  overview 
of  the  principle  of  fault-tolerance,  its  incentives  and 
methods  of  implementation  (chapter  1).   In  chapter  2  a  study 
will  be  conducted  on  the  errors  and  uncertainties  of 
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instrument  measurements  obtained  through  temperature  and 
pressure  instrumentation.   The  area  of  probabilistic  logics 
as  applied  in  instrumentation  redundancy  will  be  discussed 
in  chapter  3.   Next,  the  author  will  demonstrate  how  the 
techniques  of  averaging  and  voting  would  significantly 
improve  the  quality  of  the  signals  and  increase  the  reliabi- 
lity of  such  redundant  instrumentation  system  (chapter  4). 
In  chapter  5  a  case  study  of  some  of  the  unique  and  highly 
reliable  control  systems  at  the  Deer  Island  Sewage  Treatment 
Plant  will  be  presented.   And  finally  in  chapter  6,  the 
method  of  using  constitutive  and  conservation  laws  to 
minimize  measurement  errors  will  be  briefly  examined. 
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CONCLUSIONS 

Using  the  techniques  of  averaging,  mediating,  and  voting, 
there  is  little  doubt  that  the  overall  reliability  has  been 
greatly  increased  for  a  control  system  using  redundant 
instrumentation.   In  order  to  maximize  the  full  advantages  of 
fault-tolerance,  however,  one  must  devote  complete  attention 
to  the  implementation  of  redundant  hardware  at  the  outset  of 
system  design. 

It  can  be  concluded  that  multiplexing  techniques  such 
as  averaging  and  voting  can  indeed  increase  the  reliability 
of  any  redundant  instrumentation  system,  as  shown  by  pro- 
babilistic analysis  and  experimental  verifications.   Moreover, 
the  implementation  of  such  techniques  is  easily  realizable, 
as  the  author  has  illustrated  v/ith  an  example.   Furthermore, 
due  to  the  high  frequency  spectral  content  of  a  voter  output, 
the  technique  of  multiplexing  can  actually  be  utilized  to 
simplify  the  task  of  noise  reduction. 

And  finally  as  indicated  in  chapter  6,  instrument  error 
distribution  within  a  real-time  system  is  indeed  an  important 
aspect  of  redundant  instrumentation.   Much  more  work  needs  to 
be  done  in  this  area. 
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CHAPTER  I  . 
INTRODUCTION  TO  ENGINEERING  OF  RELIABILITY 

A.    Introduction 

If  for  example  one  simply  installs  a  redundant 
instrument  at  the  temperature  sensing  point  in  a  thermal 
power  plant,  there  is  no  question  that  the  reliability  of 
the  temperature  measurement  has  been  increased.   This  is 
due  to  the  simple  fact  that  if  one  instrument  malfunctions, 
a  second  instrument  is  still  available  to  measure  the  para- 
meter.  However,  if  one  ponders  for  a  moment,  he  begins  to 
wonder  if  he  could  improve  the  quality  of  the  measurements  at 
all  times,  even  when  there  is  no  instrumentation  malfunction 
at  all.   This  question  is  especially  valid  if  one  recognizes 
the  fact  that  temperature  sensing  devices  come  in  many  differ- 
ent types,  e.g.  RTJDs,  thermistors,  and  thermocouples;  all  of 
these  instruments  have  their  own  inherent  errors  and  uncertain- 
ties.  Could  one  improve  the  quality  of  the  measurements  so 
that  the  output  signal  is  always  equal  to  the  best  of  the 
signals  from  the  different  primary  sensors?   The  answer  is, 
"Yes,  a  fault-tolerant  system  can  do  just  that".   The  reader 
will  see  why  in  the  pages  to  follow. 

Fault-tolerance  is  the  architectural  attribute  of  a  di- 
gital system  that  keeps  the  logic  machine  doing  its  specified 

tasks  when  its  host,  the  physical  system,  suffers  various 

(1) 
kinds  of  failure  of  its  components.     A  fault-tolerant 
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system  using  redundant  instrumentation  does  more  than  that; 
even  during  normal  operations,  the  logic  circuitry  is  able  to 
select  the  best  possible  signal  using  various  multiplexing 
techniques. 

A  fault-tolerant  control  system  using  redundant  instrument- 
ation can  be  illustrated  by  the  flowchart  in  Fig.  1.1. 


PRIMARY 
MEASUREMENTS 

ANALYZER 

OUTPUT 

Multiple  Signals 
from 
Redundant  Instruments 


Process  of  Selecting 
the  Most 
Reliable  Signal 


Fig.  1.1  A  Control  System  Flowchart 


Considerable  research  has  been  performed  in  the  area  of  the 
center  block,  the  complex  process  of  assuring  that  a  most 
reliable  signal  is  always  available.   On  the  other  hand,  very 
little  work  has  been  done  to  combine  the  advantages  of 
redundant  instrumentation  with  the  highly  reliable  techniques 
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of  multiplexing.   In  fact,  since  Dean  Karnopp  and  Erich 

Bender  first  reported  their  experimental  findings  for  an  analog 

(2) 
system  in  1966,     hardly  any  other  reports  have  surfaced. 

The  entire  chapter  2  has  been  devoted  to  the  errors  and 
uncertainties  of  primary  instrumentation,  so  no  further  mention 
of  this  subject  matter  will  be  made  here.   Instead,  the  rest 
of  this  chapter  will  be  used  to  introduce  to  the  reader  the 
concept  of  fault-tolerance,  a  term  many  engineers  have  an 
idea  of  what  the  final  output  is,  but  barely  have  any  notion 
of  the  manner  in  which  the  system  performs  its  function. 
Actually,  the  term  "fault-tolerance"  has  only  been  used  in 
connection  with  digital  systems  for  the  last  5  to  10  years. 
However,  the  concept  of  fault-tolerance,  or  more  explicitly, 
the  term  "redundancy",  has  been  in  the  standard  vocabulary 
of  most  design  engineers  since  the  1960's. 

The  logic  circuitry  mentioned  in  the  preceding  paragraphs 
could  be  basically  made  up  of  simple  passive  elements  like 
AND  or  OR  gates.   They  could  be  logic  circuits  that  would 
select  the  upper  or  lower  value  from  a  set  of  signals;  or  the 
circuit  could  simply  select  the  median  from  the  same  set  of 
signals.   In  any  event,  when  one  instrument  does  fail,  the 
resultant  reading  can  be  either  high  or  low,  or  none  at  all, 
but  the  logic  circuitry  can  take  care  of  that  by  either 
masking  the  physical  fault  from  being  transmitted  further 
downstream,  or  in  some  pre-programmed  fashion,  acts  to  continue 
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to  provide  a  reasonable  output,  although  somewhat  degraded. 
Chapter  4  will  discuss  the  actual  multiplexing  techniques  in 
detail. 

Some  electrical  engineers  share  the  viewpoint  that  the 
presence  of  fault-tolerance  features  does  not  add  any  perform- 
ance advantages  during  normal  (fault-free)  operation.   More- 
over, they  state  that  fault- tolerance  requires  additional  hard- 
ware that  is  redundant  during  normal  operation  and  would  be 
entirely  superfluous  in  a  completely  fault-free  logic  machine. 

The  author  wishes  to  point  out  that  in  a  fault-tolerant 
control  system  that  uses  redundant  instrumentation,  the  fault- 
tolerance  feature  actually  improves  the  overall  quality  of  the 
various  signals  and  improves  the  reliability  of  the  entire 
system  even  during  normal,  fault-free  operation. 

B.    Reasons  for  Fault- tolerance 

What  are  some  of  the  incentives  for  implementing 
fault-tolerance  into  a  control  system?   The  objective  of 
minimizing  downtime  was  mentioned  earlier,  but  there  are 
other  advantages  that  have  not  been  mentioned. 

In  a  thermal  power  system,  if  there  is  only  one  RTD  at  a 
critical  temperature  sensing  point,  or  perhaps  just  one  diaph- 
ragm at  the  pressure  sensing  point,  then  if  the  instrument 
malfunctions,  the  usual  solution  to  the  problem  is  a  manually 
controlled  maintenance  action  that  results  in  the  removal 
or  repair  of  the  cause  of  the  fault.   The  system  is  then 
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restarted  to  run  until  the  next  fault  strikes.   The  purpose 
of  fault-tolerance  is  to  offer  an  alternate  solution  to  the 
fault  problem  in  which  the  detection  of  faults  and  the 
recovery  to  normal  operation  are  carried  out  as  internal 
functions  of  the  system  itself.   In  this  regard,  fault- 
tolerance  can  be  considered  as  the  survival  attribute  of  the 
logic  machine  because  its  function  is  to  return  the  system 
from  error  states  back  to  certain  specified  behavior. 

Without  fault-tolerance,  a  typical  malfunction  or 
failure  usually  occurs  in  the  following  sequence:   The  event 
begins  with  the  observation  of  erratic  behavior  and  a  call 
to  the  maintenance  expert  and  ends  with  the  resumption  of 
normal  operation  N  hours  later,  with  N  usually  found 
somewhere  in  the  range  of  0.1  £  N  £10.   If  fault-tolerance 
is  now  incorporated  into  the  control  system,  human  particip- 
ation in  recovery  is  eliminated,  and  N  can  be  lowered  to  the 
range  of  10~9  to  10~"6  hour/1^  . 

Historically,  fault-avoidance  has  been  used  as  the 
alternative  to  fault-tolerance.   Unlike  fault-tolerance, 
fault-avoidance  requires  the  physical  components  and  their 
assembly  techniques  to  be  as  nearly  perfect  (fault-free) 
as  possible.   In  addition,  shielding  must  be  installed  to 
keep  out  all  forms  of  external  interference.   The  Apollo 
space  program  was  an  excellent  example  of  fault-avoidance. 
Every  single  component  was  made  to  perfection;  and  the 
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result,  as  the  reader  knows,  was  a  flawless  space  flight  in 
every  launch. 

As  one  might  expect,  fault -avoidance  has  some  drawbacks, 

(1) 
and  they  are  by  no  means  minor.   '   First,  not  surprisingly 

to  anyone,  is  that  it  is  very  expensive.   The  cost  of  obtain- 
ing nearly-perfect  components  in  an  instrument  rises  very 
rapidly  after  failure  rates  have  been  reduced  to  threshold 
values  that  are  characteristic  of  the  physical  parameters  and 
manufacturing  technology  of  the  components.   Second,  since 
the  system  will  cease  proper  operation  with  the  first  failure 
or  malfunction,  manual-maintenance  personnel  must  stand  by 
continuously  with  appropriate  fault-location  and  fault-removal 
tools  and  methods.   This  requirement  represents  a  major  budget 
item  for  the  life-cycle  cost  of  the  system. 

The  acquisition  cost  of  a  fault-tolerant  system  is  higher 
than  that  of  a  fault -avoidance  system.   This  additional  cost 
is  due  to  the  extra  effort  required  to  introduce  fault- 
tolerance  during  system  design  stage  and  by  the  cost  of  redun- 
dant hardware  and  software  that  implement  fault  detection  and 
recovery. 

However,  the  high  initial  cost  could  be  more  than  comp- 
ensated for  by  the  lower  life-cycle  cost.   The  reduction  in 
life-cycle  cost  is  a  result  of  the  following  reasons.   First 
of  all,  lower  cost  components  can  now  be  used  because  higher 
failure  rates  can  be  accepted  for  individual  components  with- 
out degrading  system  reliability.   Secondly,  a  sharp  decrease 
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in  downtime  will  lead  to  a  considerable  lower  life-cycle  cost 
of  system  operation.   And  finally,  scheduled  off-line 
replacement  of  rejected  parts  should  cost  much  less  than  pro- 
viding a  crew  of  continuously  ready  maintenance  experts. 

Without  redundancy  and  fault- tolerance ,  an  unpredictable 
shutdown  in  a  power  generation  and  distribution  plant  may 
represent  a  tremendous  loss  in  revenue.   Another  example  with 
the  same  result  is  the  electronic  fund  transfers,  or  the 
telephone  switching  systems.   Besides  cost  saving,  however, 
there  are  other  features  of  a  fault-tolerant  system  that  make 
it  highly  desirable.   Human  lives  could  be  endangered  if  a 
failure  occurs  in  some  applications.   Some  of  the  examples  are 
air  traffic  control,  automatic  control  of  a  submarine  in  a 
diving  maneuver,  control  of  nuclear  power  plants  and  defense 
systems,  and  patient  monitoring  and  life  support  systems  in 
highly  automated  hospitals. 

Still,  a  third  group  of  control  systems  that  would 
benefit  immensely  from  fault-tolerance  consists  of  systems  in 
environments  that  do  not  allow  access  for  manual  maintenance, 
such  as  satellite  in  earth  orbit;  nuclear  reactor  instrument- 
ation in  a  highly  radioactive  enclosure;  unmanned  underwater 
stations;  and  environment-monitoring  stations  in  remote  and 
hard-to-reach  locations. 

And  finally,  there  is  a  strong  psychological  incentive 
for  implementing  fault-tolerance  in  any  control  system. 
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When  an  operator  knows  that  the  failure  of  a  system  can 
jeopardize  a  person's  safety  or  economic  well-being,  or 
possibly  the  very  first  component  failure  will  be  fatal  to 
the  uninterrupted  operation  of  the  entire  machine,  the 
knowledge  that  fault-tolerance  is  being  used  is  more  than 
likely  to  considerably  reduce  his  anxiety. 

The  author  wishes  to  clarify  one  point  at  this  time. 
There  are  distinct  differences  between  primary  sensor  reliabi- 
lity and  computer  (logic  circuitry)  reliability.   Primary  sen- 
sor reliability  deals  with  the  reliability  of  the  instruments 
themselves.   Obviously,  each  instrument  has  its  own  failure 
rate;  some  are  more  prone  to  failure  than  others.   In  addition, 
each  instrument  has  its  own  range  of  uncertainties  and  errors, 
inherent  to  any  particular  type  of  sensor.   On  the  other  hand, 
logic  circuitry  reliability  deals  with  the  failure  rates  of 
actual  circuit  elements.   The  circuit  elements,  almost  exclu- 
sively, are  passive  components  like  diodes,  resistors,  and 
OR  gates.   As  compared  to  the  instruments,  these  passive 
elements  are  highly  reliable,  at  least  partly  due  to  their 
well-controlled  environments  both  in  manufacture  and  in  use. 
More  discussion  on  this  subject  can  be  found  in  chapter  4. 

C.    Implementation  of  Fault-tolerance 

So  far  in  this  chapter,  the  discussion  has  been 
almost  exclusively  devoted  to  the  following  two  areas: 
(1)   The  interaction  between  the  logic  circuitry  and  the 
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physical  instrumentation  system,  and  (2)   the  incentives 
for  implementing  fault-tolerance.   It  is  now  time  to 
describe  the  common  methodology  for  actual  implementation. 

Typically  the  control  system  is  invariably  designed 
for  perfect  components,  assuming  fault-free  conditions. 
Then,  fault-tolerance  is  introduced.   This  sequence  implies 
additional  provisions  must  be  made  to  add  more  hardware  and 
software  elements.   These  redundant  instruments  and  circuit 
elements  will  serve  to  provide  the  fault-handling  algorithms 
and  the  spare  parts  needed  for  recovery. 

Fault-tolerance  can  be  introduced  into  a  control  system 
through  a  systematic  sequence  of  design  activities  like  the 
following: 

(1)   Reliability  Requirements  Reliability  require- 
ments must  be  specified;  in  other  words,  a  set  of  performance 
specifications  must  be  defined. 

Fault-tolerance,  in  this  case,  is  limited  to  the  tole- 
rance of  physical  faults  in  each  channel.   A  physical  fault 
is  an  out-of-specification  or  otherwise  undersirable  change 
in  the  values  of  one  or  more  primary  parameters  in  the  system. 
It  is  caused  by  a  physical  failure  or  degradation  that  affects 
a  primary  sensor  and  may  make  either  a  permanent  or  temporary 
change  in  the  sensed  values  of  the  corresponding  physical 
variable. 

Permanent  physical  faults  are  usually  caused  by  irrever- 
sible changes  in  components,  such  as  broken  RTDs,  open 
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connections,  ruptured  bellows,  "bridging"  between  two  leads, 
etc.   Temporary  faults,  on  the  other  hand,  are  generally 
results  of  external  interferences  of  relatively  short  duration, 
typically  in  power  supplies  or  in  signal  transmission.   These 
interferences  change  the  present  values  of  certain  measurements, 
but  do  not  cause  irreversible  damages  to  the  components. 

After  a  quantitative  reliability  requirement  has  been 
established,  the  number  of  redundant  channels  needed  can  be 
determined.   Each  redundant  primary  instrument  with  its  asso- 
ciated branch  of  the  logic  circuitry  constitutes  a  redundant 
channel.   From  experimental  results  and  other  evidence,  it 
appears  likely  that  the  triply  redundant  system  is  the  optimal 
choice. 

(2)   Fault-Detection  Algorithms  The  detection  function 

is  the  starting  point  of  most  fault-tolerant  implementations. 
This  function  usually  leads  to  the  addition  of  new  components. 
The  choice  of  fault-detection  techniques  is  governed  by  the 
reliability  specification,  making  certain  that  all  relevant 
fault  classes  are  detectable,  and  that  the  probability  of 
timely  detection  is  adequate  with  respect  to  the  reliability 
goals.   Both  hardware  and  software  techniques  are  applicable 
here. 

The  various  methods  for  fault  detection  can  be  summarized 
as  follow: 

(a)   Initial  testing,  which  takes  place  prior  to 
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normal  use  and  serves  to  identify  faulty  instrument 

components  containing  imperfections  introduced  during 

(3) 
the  manufacturing  or  assembly  process. 

(b)  Concurrent  (on-line)  detection,  which  the 
author  considers  as  the  most  important  method  because 
after  all,  the  underlying  advantage  of  any  automatic 
control  system  is  its  self-checking  feature.   It  is 
implemented  by  means  of  special  hardware  or  software 
that  operates  concurrently  with  the  regular  programs 
of  the  system.   Concurrent  detection  is  important 
because  it  allows  recovery  to  be  initiated  before  fault- 
caused  errors  can  cause  extensive  disruption  of  programs 
or  damage  to  the  data.   Hardware  methods  for  concurrent 
detection  have  been  used  for  quite  some  time,  especially 
in  the  computer  and  aerospace  industries.   These  methods 
include  error-detection  codes  (chapter  5) ,  duplication 
and  comparison,  disagreement  detectors  with  voters 
(chapters  3  &  4) ,  and  plant  status  and  completion  signals 
(chapter  5) . 

(c)  Scheduled  (off-line)  detection,  which  takes 
place  when  normal  operation  is  temporarily  interrupted. 
This  method  is  quite  similar  to  the  initial  testing 
except  that  now  the  testing  is  executed  by  the  system 
itself. <4'5> 

(d)  Redundancy  testing,  which  serves  to  verify  that 
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the  various  forms  of  protective  redundancy  are  themselves 

fault-free,  and  takes  place  either  concurrently  or  at 

scheduled  intervals. 

(3)   System  Recovery  Algorithms  The  recovery  algorithm 

comprises  all  actions  that  are  initiated  by  the  arrival  of  a 
fault  signal  during  normal  operation  and  are  normally  completed 
by  the  resumption  of  normal  operation  (more  than  likely  in  a 
degraded  mode) ,  by  a  deliberate  shutdown  of  the  system,  or  by 
system  failure. 

The  most  fundamental  difference  between  various  recovery 
algorithms  is  whether  interaction  with  a  human  maintenance 
operator  is  or  is  not  required  as  part  of  the  recovery  algorithm 
Recovery  algorithms  that  do  not  require  human  decision  making 
are  automatic;  all  other  algorithms  are  manually  controlled, 
although  they  may  contain  extensive  programmed  sequences. 

In  the  computer  and  aerospace  industries,  most  recovery 
algorithms  are  fully  automatic  and  require  no  human  interven- 
tion.  When  a  certain  processor  fails,  full  recovery  simply 
involves  with  the  replacement  of  the  faulty  processor  with  a 
spare.   However,  in  the  thermal  power  industry,  in  the  opinion 
of  the  author,  human  interaction  must  play  an  important  role 
in  the  recovery  process,  at  least  in  the  foreseeable  future. 

After  recovery  has  been  completed,  the  system  can  have 
the  following  three  status:   full  recovery,  degraded  recovery, 
and  safe  shutdown. 
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Full  recovery  means  the  return  of  the  system  to  a  set  of 
conditions  that  existed  before  the  fault  occurred.   In  the 
case  of  a  thermal  power  plant,  this  procedure  usually  begins 
with  a  status  light  on  the  monitoring  panel  identifying  one 
or  more  malfunctions  have  occurred;  plant  is  operating  in  a 
degraded  mode,  and  it  is  now  up  to  the  human  maintenance 
operator  to  pinpoint  the  malfunctions  and  replace  the  damaged 
parts.   Recovery  is  concluded  when  damaged  parts  have  been 
replaced  by  spares. 

Degraded  recovery  means  that  the  system  is  still  operating 
but  at  a  reduced  capacity.   In  a  triply  redundant  instrument- 
ation system,  an  example  of  a  degraded  recovery  is  that  two 
channels  could  malfunction  simultaneously,  while  the  third 
channel  is  still  operating  perfectly.   The  result  is  a  piece 
of  data  that  is  not  totally  correct,  but  still  within  an 
acceptable  range.   The  system  v/ill  remain  in  this  mode  until 
faulty  instrument  or  component  is  replaced. 

Safe  shutdown  is  the  limiting  case  of  degraded  recovery. 
It  is  carried  out  only  when  the  remaining  computing  capacity 
(if  any)  is  below  the  minimum  acceptable  threshold.   The 
objectives  of  shutting  down  a  power  plant  are  two-folded: 

(1)  to  prevent  damage  to  remaining  plant  components;  and 

(2)  to  stop  interaction  v/ith  other  plant  system  in  a  delib- 
erate and  orderly  manner. 

A  special  case  of  hardware-controlled  recovery  is  known 
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as  recovery  by  fault  masking.   In  such  systems,  faults  are 
masked  by  redundant  hardware,  and  thus  remain  totally  in- 
visible to  the  software  further  downstream.   The  masking 
function  employs  redundancy  to  assure  that  the  effect  of 

In      o\ 

a  fault  is  completely  contained  within  a  system  module.   ' 
As  long  as  the  redundancy  is  not  exhausted,  the  fault  is 
concealed  within  the  module  and  no  symptoms  whatsoever  appear 
on  its  outputs.   It  is  also  known  as  a  static  redundancy 
because  if  viewed  from  the  outside,  separate  detection  and 
recovery  functions  are  not  identifiable. 

Masking  is  usually  accomplished  by  hardware  redundancy, 
i.e.  by  the  replication  of  hardware  elements.   The  redundant 
elements  are  assumed  to  be  permanently  connected,  and  to 
fail  statistically  independently.   They  have  the  same  failure 
rate  and  are  instantaneously  available  to  perform  the  masking 
of  a  failure  with  unity  probability  of  success.   One  major 
drawback  of  static  redundancy  is  that  it  must  be  introduced 
at  the  outset  of  the  design  phase.   Total  devotion  must  be 
given  to  fault-tolerance  by  the  design  engineers  throughout 
the  early  stage.   It  is  for  this  reason,  as  mentioned 
earlier,  that  the  initial  cost  of  a  control  system  featuring 
fault-tole ranee  is  considerably  higher  than  that  without 
the  same  feature . 
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D.  The  Author's  Position  on  Type  of  Signals  being  Processed 
This  is  not  a  thesis  on  signal  processing,  however, 
the  principle  of  multiplexing  as  applied  here  deals  with  the 
processing  of  signals  from  various  redundant  instrumentation. 
Therefore,  the  author  feels  that  it  is  appropriate  to  briefly 
comment  on  the  type  of  signals  being  considered  here. 

All  signals  considered  in  this  thesis  are  digital  16-bit 
parallel  words.   The  16-bit  capacity  includes  a  sign  bit  and 
an  address  bit.   Moreover,  these  parallel  words  are  results 
of  distributed  computing;  in  other  words,  the  analog-to-digital 
conversion  device  is  powered  from  an  independent  power  source. 
1.    Why  Digital? 

Digital  technology  has  indeed  revolutionized 
the  world  of  instrumentation.   Reductions  in  cost  of 
digital  integrated  circuits  and  the  increase  of  chip 
complexity  are  rapidly  making  feasible  the  manufacturing 
of  digital  equipment  at  a  small  fraction  of  the  cost  for 
their  analog  counterparts.   As  a  result,  it  is  consider- 
ably easier  and  less  expensive  to  find  a  digital  system 
to  suit  one's  need  as  compared  to  finding  an  analog 
system  that  performs  the  same  function. 

Digital  systems  often  capitalize  on  having  a  compat- 
ible data  base.   This  is  exemplified  by  a  large  and 
complex  process-control  system  in  which  temperatures, 
pressures,  and  flow  rates  are  all  converted  into  numbers. 
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No  matter  what  input  is  considered,  its  value  ends  up  in 
the  system  as  a  number.   In  this  form,  it  can  be  easily- 
added,  multiplied,  integrated,  or  otherwise  processed. 

2.  Parallel  Conversion 

The  best  feature  of  this  conversion  approach 
is  that  conversion  occurs  in  parallel,  with  speed  limited 
only  by  the  switching  time  of  the  comparators  and  gates. 
As  the  input  changes,  the  output  code  changes.   Therefore, 
this  is  indeed  the  fastest  approach  to  conversion. 
Only  a  few  years  ago,  A/D  conversion  was  done 
strictly  in  a  serial  format,  bit  by  bit.   Parallel  conver- 
sion was  not  commonly  practiced  at  the  time  because  the 
number  of  elements  needed  in  a  parallel  conversion 
increases  geometrically  with  resolution.   However,  with 
the  advent  of  LSI  and  VLSI  technologies,  it  is  now 

possible  to  have  high  resolution  and  fast  speed  at  the 

(9) 
same  time. 

3.  Distributed  Computing 

Distributed  computing  simply  means  that  the 
A/D  conversion  and  related  processing  will  be  done  right 
at  the  signal  source  with  an  independent  power  supply. 
This  technique,  when  utilized  in  a  redundant  instrument- 
ation system,  accomplishes  two  objectives:   first,  it 
increases  system  reliability  because  a  power  failure 
will  only  affect  that  particular  channel;  and  secondly, 
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by  transmitting  digital  data  back  to  the  data  center, 
a  considerable  immunity  to  line-frequency  (50-60-400  HZ) 
pickup  and  ground-loop  interference  is  achieved. 

The  author  does  not  intend  to  cover  the  subject  of 
A/D  conversion  in  any  great  detail  here;  if  the  reader 
is  interested,  however,  reference  (9)  provides  excellent 
further  readings  in  this  area. 

From  the  general  introduction  in  the  preceding  paragraphs, 
it  is  hoped  that  the  reader  has  gained  some  knowledge  of  how 
a  fault-tolerant  system  performs  and  why  its  implementation 
is  important  to  a  thermal  power  plant.   In  the  next  chapter, 
various  kinds  of  typical  power  plant  instruments,  e.g.  temp- 
erature and  pressure  sensors,  will  be  described,  along  with 
the  uncertainties  and  errors  peculiar  to  each  type  of  instru- 
ment. 
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CHAPTER  II 
INSTRUMENTATION  ERRORS  AND  UNCERTAINTIES 

A.    Introduction 

If  an  instrument  does  not  seem  to  have  malfunct- 
ioned, then  why  should  one  worry  about  errors  and  uncer- 
tainties?  Likewise,  if  an  instrument  appears  to  be  as  good 
as  the  day  it  came  off  the  production  line,  why  should  the 
measurements  not  be  all  accurate? 

Of  course,  when  an  instrument  becomes  faulty  as  a  result 
of  an  open  connection,  a  mechanical  failure,  or  a  bridging 
of  two  adjacent  leads,  to  name  only  a  few  examples,  the 
measurement  may  become  totally  erroneous  with  a  reading 
several  magnitudes  different  from  a  normal  reading.   In  this 
case,  the  instrument  would  simply  have  to  be  replaced  at  the 
first  opportunity. 

Thus,  as  one  can  see,  an  instrument  can  malfunction  at 
any  time,  depending  on  its  own  failure  rate;  but  in  addition, 
even  when  it  is  operating  under  normal  conditions,  its 
reading  can  still  be  out-of-specif ications  simply  due  to 
inherent  errors  and  uncertainties.   The  reader  must  realize, 
however,  that  each  sensing  device  possesses  unique  charact- 
eristics that  make  it  especially  desirable  in  a  particular 
application. 

In  this  chapter,  temperature  and  pressure  sensors,  the 
two  most  important  and  commonly  found  instruments  in  a 
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thermal  power  plant,  will  be  explored.   Their  calibration 
drift  rates,  noise  figures,  accuracy,  and  other  errors  will 
be  examined.   In  particular,  platinum  resistance  temperature 
detectors  (RTDs)  will  be  discussed  as  a  specific  case-in-depth 
to  illustrate  the  origins  and  nature  of  some  of  the  instru- 
mentation errors.   Reference  (10)  contains  a  comprehensive 
collection  of  literature  on  various  industrial  thermometers. 
Then  in  chapter  4,  the  techniques  of  minimizing  the  effects 
of  these  errors  will  be  explained  in  detail. 

Even  without  dwelling  upon  the  theories  of  probabilities 
and  statistics,  one  can  assume  that  the  probability  for  three 
different  types  of  instruments  (a  triply  redundant  case)  to 
generate  similar  errors  (both  in  sign  and  magnitude)  is  very 
remote.   It  is  here  that  redundancy  demonstrates  its  most 
salient  advantage.   The  use  of  redundant  instrumentation 
coupled  with  the  technique  of  averaging  or  voting  will  yield 
the  most  reliable  and  least  noisy  signal  at  all  times,  as 
the  reader  will  see  in  chapter  4. 

B.    Resistance  Temperature  Detectors 

Two  of  the  most  widely  used  temperature  sensing 
devices  are  resistance  thermometry  and  thermoelectric 
thermometry.   Resistance  thermometry  can  be  divided  con- 
veniently into  two  basic  groups:   resistance  temperature 
detectors  (RTDs)  and  thermally  sensitive  resistors 
(thermistors).   Thermoelectric  thermometry  will  be  discussed 
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later.   RTDs  are  basically  electrical  circuit  elements  formed 
of  solid  conductors  (usually  in  wire  form)  that  are  charact- 
erized by  a  positive  coefficient  of  resistivity.   The  RTDs 
of  general  usage  are  of  platinum,  nickel,  and  copper. 

There  is  no  question  that  platinum  is  one  of  the  best 
materials  for  a  resistance  temperature  detector,  nevertheless, 
it  exhibits  certain  calibration  drifts  and  errors  during  both 
testing  and  normal  operations.   A  thorough  evaluation  was 
conducted  on  the  performance  of  several  industrial  platinum 
thermometers  between  0   and  650  C  by  the  Oak  Ridge  National 
Laboratory,  and  some  of  the  findings  are  briefly  summarized 
in  the  following  pages. 

1.    Insulation  Resistance 

Consideration  of  insulation  resistance  is 
significant  because  it  could  indicate  that  measurement 
errors  might  be  caused  by  shunting  of  the  sensing 
element  due  to  leakage  of  current  to  the  sheath  and  bet- 
ween lead  wires.   In  the  experiment  conducted  by  the 
Oak  Ridge  Laboratory,  it  was  found  that  insulation 
resistance  varied  widely  for  similar  type  of  thermometers, 
but  from  different  manufacturers.   But  more  importantly, 
it  was  also  discovered  that  even  for  thermometers  in 
the  same  group  purchased  from  the  same  manufacturer, 
resistance  differences  of  several  decades  were  not 
uncommon. 
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2.  Thermal  Emf's 

Experimental  results  indicate  that  in  order 
to  reduce  thermal  emf's,  parallel  lengths  of  wires  in 
the  thermometer  must  have  similar  thermoelectric 
properties,  and  thermal  gradient  between  lead  and 
points  of  lead  attachment  must  be  minimized. 

3.  Calibration  Drift  Test 

A  summary  of  the  calibration  drift  test 
results  is  tabulated  in  TABLE  2.1. 

TABLE  2.1 

Manufacturer 
BCD 


Number  of  thermometers 
tested 

Number  that  failed 
immediately 

Number  that  failed  v/ithin 
1000  h 

Number  that  survived 
6000  h 

Maximum  differential 
drift  in  °C ,  after  6000  h 

Maximum  absolute  drift 
in  °C  after  6000  h 


0 


1.0 


1.1 


0 


0 


0.5 


0.9 
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In  the  worst  case,  the  absolute  accuracy  of  the 
thermometers  changed  approximately  1  C.   Some  thermo- 
meters had  positive  errors,  while  others  developed 
a  negative  drift. 

4.  Thermal  Cycling 

All  thermometers  survived  1000  cycles  without 
breakage  after  they  were  cycled  between  260  C  and 
50  C.   When  the  temperature  limits  were  changed  to 
cycle  between  760   and  80  C  at  a  maximum  rate  of  8  C/sec, 
half  of  the  thermometers  failed  within  31  cycles. 

5.  Effect  of  Crystal  Defects 

It  is  obvious  from  the  preceding  paragraphs 
that  platinum  RTD  may  cause  certain  temperature  drift 
during  service,  and  may  even  fail  when  subject  to 
severe  thermal  cycling.   Errors  may  also  occur  as  a 
result  of  crystal  defects  or  fabrication  imperfection. 
The  introduction  of  such  physical  defects  into  a 
crystalline  material  like  platinum,  will  cause  an 
increase  in  its  electrical  resistivity  and  therefore 

4-     4.   (12) 

an  error  on  its  output. 

C.    Thermistors 

Thermistors  are  electrical  circuit  elements  formed 
of  solid  semiconducting  materials  that  are  characterized  by 
a  high  negative  coefficient  of  resistivity.   At  any  fixed 
temperature,  a  thermistor  acts  exactly  as  any  ohmic  con- 
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ductor.   Typical  thermistor  resistance  variations  are  from 
50,000X1  at  3S°C  to  200  A  at  260°C.   3' 

Some  of  the  semiconductor  materials  that  are  commonly 
used  to  manufacture  thermistors  are  carbon,  germanium,  and 
silicon.   The  author  will  concentrate  on  the  application 
of  thermistors  to  temperatures  below  100  K  or  -173  C. 
There  are  two  important  reasons  for  this  selection.   First, 
materials  and  methods  of  thermometry  which  are  well  developed 
for  higher  temperatures  often  fail  at  lower  temperatures. 

Second,  problems  associated  with  the  application  of  ther- 

(14) 
mistors  become  more  serious  as  the  temperature  is  reduced. 

1.  Temperature  Dependence 

When  carbon  resistance  thermometers  are 
monitored  at  a  fixed  low  temperature,  their  resistance 
is  observed  to  drift  with  time.   As  the  temperature  is 
lowered,  the  drift  becomes  more  serious.   If  one  requires 
a  stable  carbon  resistance  thermometer,  he  must  sacrifice 
temperature  resolution.   Part  of  this  loss  in  resolution 
can  be  restored,  however,  by  using  a  resistance  bridge 
capable  of  a  greater  resolution.    ' 

2.  Power  Dissipation 

The  measurement  of  resistance  requires  power 
dissipation  in  the  thermometer.   Thus,  power  dissipation 
must  be  kept  small  to  avoid  excessive  measurement  error. 
It  has  been  found  that  a  power  dissipation  as  little  as 
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-12 
5x10     W  in  a  carbon  resistor  at  0.04  K  caused  about 

( 14) 
a  one  percent  error  in  AT/T. 

3.    Self  Heating 

Another  problem  that  is  not  so  easily  detected 
is  pov/er  dissipation  resulting  from  rf  voltages  induced 
in  the  leads  by  commerical  radio  transmitters.   This 
effect  is  known  as  self-heating  and  is  a  problem  common 
to  both  carbon  and  germanium  thermistors.   Error  caused 
by  such  spurious  pov/er  dissipation  becomes  much  more 
serious  as  the  temperature  is  reduced.   In  areas  exposed 
to  large  rf  fields,  the  electronics  must  be  placed  in 
a  shielded  enclosure;  otherwise,  the  placement  of  a  low 
pass  filter  in  the  electrical  lead  near  the  resistance 
thermometer  may  be  sufficient.   An  efficient  and  ade- 
quate heat  sink  also  appears  to  be  an  effective  method 

(17) 
to  minimize  such  error. 

D.    Noble  Metal  Thermocouples 

Obviously,  a  perfect  thermocouple  would  be  one  that 
produces  an  emf  signal  that  is  uniquely  related  to  the  temp- 
erature of  the  hot  junction  and  is  unaffected  by  time  or  any 
other  factor.   Although  noble  metals  like  platinum  are 
superior  to  most,  no  materials  of  construction  are  completely 
stable  in  this  regard.   Mechanical  failure  is  a  major 
contributing  factor  to  instrument  malfunction,  but  in  the 
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absence  of  that,  thermocouple  deterioration  is  usually  caused 
by  changes  of  composition  which  influence  the  emf  developed 

over  the  temperature  gradient  to  which  the  couple  is 

w  «   4-  ^  (18) 
subjected. 

A  highly  corrosive  environment  appears  to  be  the  major 
cause  for  compositional  changes.   Most  environments  above 
1300  C  are  fairly  hostile;  in  addition  to  vapor  transport 
processes  associated  with  the  formation  of  volatile  oxides, 
chemical  reactions  can  also  occur  between  the  thermocouple 
wires  and  the  insulating  materials  with  which  they  are  in 
contact. 

1.    Contamination 

Mechanical  failures  of  platinum  thermocouples 
are  sometimes  caused  by  contamination  during  fabri- 
cation.  The  embrittlement ,  which  sometimes  occurs 
when  platinum  thermocouples  are  heated  in  contact  with 
alumina  insulators  under  reducing  conditions  at  temp- 
eratures above  1200  C,  is  usually  associated  with 
the  presence  of  silicious  impurities  in  the  refractory. 
This  type  of  reaction  results  in  the  formation  of  low 
melting  point  alloys,  and  the  thermocouple  usually 

fails  abruptly  before  a  serious  change  in  thermal  emf 

( 18 ) 
has  occurred.       Silicious  impurities  are  usually 

introduced  during  the  wire  drawing  process  of  platinum. 
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2.  Thermal  Drift 

Thermoelectric  stability  becomes  an  important 
issue  v/hen  an  instrument  operates  continuously  for 
thousands  of  hours.   Experimental  results  indicate  that 
thermal  drift  is  related  to  compositional  changes 
because  the  drift  has  been  found  to  be  a  direct  result 
of  change  in  the  chemical  composition  or  metallurgical 

structure  of  the  thermocouple  materials  after  exposing 

(19) 
to  a  thermal  gradient. 

Some  of  the  operating  conditions  that  affect  the 

amount  of  thermoelectric  drift  are  as  follow: 

(a)  temperature  level,  (b)  time,  (c)  temperature  gradient, 

(d)  environmental  gas,  (e)  pressure  level,  (f)  thermal 

(19) 
cycling,  and  (g)  nuclear  radiation. 

3.  Temperature  Errors  due  to  Catalytic  Surface  Burning 

When  a  metal  thermocouple  is  exposed  to  various 
incompletely-burned  gases  that  exist  in  some  engine 
exhaust  gases,  it  is  entirely  possible  for  catalytic 
burning  to  occur  on  the  surface  of  the  thermocouple. 
This  burning  will  raise  the  temperature  of  the  ther- 
mocouple to  a  value  that  is  higher  than  that  of  the 

(20  21) 

surrounding  gas  medium.    ' 

In  order  to  eliminate  catalytic  reaction,  design 
engineers  have  recommended  coating  the  temperature 
probe  with  a  non-catalytic  material.   Some  of  these 
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non-catalytic  coatings  include  potassium-chloride  and 

(2.2.} 

oxidized  chromium. 

Variable  Resistance  Pressure  Transducers 
1.    Potentiometric  Pressure  Transducers 

A  potentiometric  pressure  transducer  is  a 
device  consists  of  three  main  components:   the  force 
collector,  the  sliding  contact  wiper,  and  the  resist- 
ance wire  winding.   The  pressure  to  be  measured  is 
applied  to  the  force  collector  which,  through  a  linkage 
rod,  moves  a  sliding  contact  across  the  electrical 
resistance  wire  windings,  thus  producing  a  voltage 
proportional  to  the  pressure.   A  diagram  that  illustrates 
the  basic  operating  principles  of  such  transducer  is 
shown  in  appendix  I.   For  more  detailed  descriptions 
and  specifications  of  various  commercially  available 
pressure  transducers,  the  AGARD  publication  "Wind 
Tunnel  Pressure  Measuring  Techniques"  (23)  and  the 
ISA  "Transducer  Compendium"  (24)  may  be  consulted. 

Resolution  and  electrical  noise  are  the  two  most 
severe  problem  areas  associated  with  the  use  of 
potentiometric  transducers,  especially  those  employing 
wire  winding  resistance  elements.   As  the  wiper  moves 
across  the  windings,  a  step  resistance  change  is 
generated  when  the  wiper  disconnects  with  one  winding  or 
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makes  contact  with  another.   The  amplitude  of  this  step 
change,  and  therefore  the  resolution,  depends  mainly 
upon  the  geometry  of  the  wire  windings  and  wiper.   A 
nominal  value  of  resolution  for  most  potentiometric 
transducers  is  0.2  percent  of  full  scale.    ' 

Electrical  noise  is  generated  due  to  variation  in 
contact  resistance  as  the  wiper  travels  over  the 
resistance  element.   Contact  pressure  fluctuations  and 
particle  contamination  at  the  wiper-wire  contact  are 
usually  the  causes  for  these  variations.   This  noise 
generation  tends  to  increase  with  the  life  of  the 
instrument  because  of  wear  and  misalignment  of  the 
wiper  and  track.   Noise  spikes  may  also  be  caused  by 
variations  which  tend  to  lift  the  wiper  from  the 
resistance  element.   In  addition,  any  linkage  required 
in  the  transducing  system  will  cause  the  instrument  to 
be  more  sensitive  to  vibration.   Recent  transducer 
designs  use  the  method  of  oil  damping  on  the  linkages 
and  elastic  elements  to  reduce  the  harmful  effects 
of  vibration. . 

In  general,  the  potentiometric  transducers  should 
be  used  in  areas  of  low  acceleration  primarily  for  the 
measurement  of  static  pressures. 
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2.    Strain-Gage  Pressure  Transducers 

A  strain-gage  pressure  transducer  is  an  instru- 
ment in  which  a  pressure  change  caused  by  the  strain  in 
a  strain  gage  is  converted  into  a  change  in  resistance. 
More  details  on  this  type  of  transducers  and  their 
electrical  schematic  diagrams  can  be  found  in  appendix  I. 

Full-scale  pressure  ranges  from  0  to  0.1  psi  to 
0  to  100,000  psi  are  provided  from  various  types  of 
strain-gage  transducers.   In  some  models,  static  error 
bands  as  low  as  0.1  percent  of  full  scale  can  be 
achieved.   If  temperature  compensation  technique  is  used, 
transducers  with  temperature  sensitivities  as  low  as 
0.25  percent  of  full  scale  can  be  fabricated.   Most 
strain-gage  transducers  are  somewhat  sensitive  to 
acceleration  and  vibration.   Moreover,  in  pressure  ranges 

below  10  psi,  errors  of  0.5  percent  of  full  scale  per 

(23) 

g  are  not  uncommon. 

F.    Diaphragm-Type  Variable  Reluctance  Transducers 

A  variable  reluctance  pressure  transducer  commonly 
used  in  the  power  industry  employs  a  magnetic  diaphragm  as 
the  sensing  element,  supported  between  two  inductance  core 
assemblies.   The  diaphragm  deflects  when  a  differential 
pressure  is  applied  to  the  pressure  ports,  thus  changing 
the  magnetic  flux.   A  detailed  diagram  of  such  transducer 
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is  shown  in  appendix  I. 

One  of  the  major  advantages  offered  by  this  type  of 
transducer  is  its  sensitivity  and  acceleration  capabilities. 
Pressure  sensitivities  as  high  as  one  volt  per  psi  are 
available,  and  pressures  down  to  0.00003  psi  may  be  measured, 
In  addition,  due  to  the  extremely  low  seismic  mass  of  this 

sensing  device,  it  is  capable  of  withstanding  high  levels 

(27) 
of  acceleration.. 

A  major  disadvantage  of  this  transducer  is  its  sus- 
ceptibility to  particle  contamination.   If  the  fluid 
contains  particles,  they  may  easily  become  lodged  in  the 
small  air  gap  (~  0.0C1  in)  between  the  core  and  the 
diaphragm.   Consequently,  the  performance  of  the  instrument 
is  degraded  either  by  mechanical  or  magnetic  interference. 
A  second  disadvantage  of  using  this  type  of  inductive 
transducer  is  that  AC  excitation  must  be  used. 

G.    Piezoelectric  Pressure  Transducers 

Piezoelectricity  is  defined  as  an  electrical  polar- 
ization produced  by  mechanical  strain  in  crystals  belong  to 
certain  classes,  the  polarization  being  proportional  to  the 
strain  and  its  sign  related-  to  the  direction  of  the  strain. 

If  a  piezoelectric  element  is  stressed  mechanically,  its 

( 28 ) 
dimensions  change  and  an  electric  charge  is  generated. 

This  type  of  sensor  does  not  require  external  electrical 
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power  as  does  the  variable  resistance  or  the  variable' 
reluctance  transducer.   A  variety  of  piezoelectric  materials 
are  used,  with  quartz,  barium  titanate,  lead  zirconate  tit- 

anate ,  and  ceramic  elements  being  some  of  the  more  common 

„  •     (25) 
choices. 

Piezoelectric  elements  have  an  inherent  high  internal 

10       14 
resistance  (10    to  10   ohms)  and  a  low  capacitance  (5  to 

500  pF);  thus,  a  slight  leakage  resistance  path  across  the 

element  electrodes  or  across  the  electrical  connector  pins 

can  cause  erratic  operation  and  limit  the  low  frequency 

response  of  the  sensor.   Therefore,  it  is  important  to 

carefully  protect  the  piezoelectric  element  and  all  connectors 

from  moisture  or  other  contaminants  that  might  create  con- 

*      4.-      ■,    (23) 
duction  paths. 

H.    Vibration  Type  Liquid  Densitometer 

In  the  vibration  type  liquid  density  measuring 
system,  the  vibrating  tuning  fork  is  the  basic  principle  of 
operation.   The  density  device  uses  a  hollow  vibrator  element, 
similar  to  a  tuning  fork,  through  which  the  measured  liquid 
flows.   As  the  density  of  the  measured  liquid  changes,  the 
mass  and  the  resonant  frequency  also  change.   In  fact,  the 
frequency  is  inversely  proportional  to  the  square  root  of  the 
density,  60  =  K/VJ5"  .   An  electrostatic  capacitive  pickup 
electrode  connected  to  an  amplifier  converts  the  vibrator 
displacement  to  an  alternating  voltage  output,  which  corres- 
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ponds  to  the  density  of  the  liquid. 

Hardly  any  study  has  been  conducted  on  the  vibration 
type  liquid  densitometer,  thus  the  origins  and  nature  of 
errors  associated  with  this  type  of  densitometry  are  not 
commonly  known.   One  can,  however,  obtain  an  idea  of  the 

capabilities  of  such  an  instrument  by  the  following  speci- 

*4       *.-     (29) 
fications: 

3 
Measuring  range:      0.5  to  1.5  g/cm 

Span:  0.05  to  0.5g/cm 

Repeatability:        1%   of  span 

Linearity:  -  0.5%  of  span 

2 
Working  Pressure:      20  kg/cm  G  or  less 

Working  Temperature:   -10  to  100°C 

I.    Concluding  Remarks 

In  this  chapter  the  author  has  not  attempted  to 
cover  any  particular  instrument  in  great  detail;  in  fact, 
that  would  be  beyond  the  scope  of  this  thesis.   If  more 
detailed  descriptions  are  desired,  the  reader  is  advised  to 
consult  appendix  I  and  some  of  the  references  listed. 

If  the  reader  has  learned  nothing  else  in  this  chapter, 
the  author  hopes  that  he  is  now  at  least  more  aware  of  the 
fact  that  different  instruments  behave  so  differently  under 
the  same  environmental  conditions.   One  instrument  may 
yield  a  higher  than  normal  reading,  whereas  a  second  one  may 
produce  an  unusually  low  measurement;  yet  a  third  sensor 
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may  simply  fail  completely. 

In  chapters  3  and  4,  the  author  will  discuss  the  prin- 
ciples and  advantages  of  averaging,  mediating,  and  voting, 
as  applied  to  a  control  system  using  redundant  instrumentation, 
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CHAPTER  III 
PROBABILISTIC  LOGICS 

A.  Introduction 

Probabilistic  logics  entail  the  study  of  error  in 
logics,  or  in  the  physical  implementation  of  logics.   Error 
is  viewed,  according  to  J.  von  Neumann,  not  as  an  extraneous 
or  misdirecting  accident,  but  as  an  essential  part  of  the 
process  under  consideration.      Actually,  the  study  of 
probabilistic  logics  has  a  far  greater  influence;  its 
implementation  can  be  considered  as  the  predecessor  of  all 
multiplexing  techniques  (a  fundamental  concept  for  voting) 
and  coding  methodologies  (encoder  and  decoder) ,  as  the  reader 
will  see  more  clearly  in  the  paragraphs  to  follow. 

B.  Logics  and  Automata 

A.  M.  Turing(31)  in  1937  and  W.  S.  McCulloch^32^ 
in  1943  suggested  that  probabilistic  logics  can  be  best 
studied  in  terms  of  automata.   An  automaton,  as  defined 
by  von  Neumann,  is  essentially  a  "black  box"  with  a  finite 
number  of  inputs  and  a  finite  number  of  outputs.   Each 
input  and  each  output  is  capable  of  exactly  two  states,  to 
be  designated  as  the  "stimulated"  state  and  the  "unstimul- 
ated" state,  respectively. 

The  internal  functioning  of  such  a  "black  box"  is 
equivalent  to  a  set  of  specifications  determining  which 
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outputs  will  be  stimulated  in  response  to  stimulation  of 
any  group  of  inputs.   The  definition  just  mentioned  is 
precisely  the  concept  that  an  averager  or  a  voting  cir- 
cuitry (two  of  the  most  commonly  used  multiplexing  tech- 
niques) is  based  upon.   In  addition,  the  theory  of  auto- 
mata can  also  be  applied  to  the  tasks  of  encoding  and 
decoding  in  which  a  specific  number  of  inputs  can  be  con- 
verted into  either  fewer,  same,  or  greater  number  of  out- 
puts, depending  upon  the  specifications  of  a  particular 
"black  box".   Therefore,  an  understanding  of  probabilistic 
logics  is  useful  if  one  wishes  to  learn  more  about  the 
never-ending  quest  of  higher  reliability  in  a  control 
system. 

C .    The  Technique  of  Multiplexing 

If  the  inputs  and  outputs  are  bundled  together, 
an  automaton  can  now  be  represented  like  that  in  Fig.  3.1. 
All  messages  will  be  carried  simultaneously  on  a  bundle  of 
N  lines  (N  being  a  large  integer)  instead  of  just  a  single 
or  double  strand.   Instead  of  requiring  that  all  or  none 
of  the  lines  of  the  bundle  be  stimulated,  a  certain  critical 
(or  fiduciary)  level  A  is  set:  0  <  A  <  Yz.      The  stimulation 
of  >   (1-A)  N  lines  of  a  bundle  is  interpreted  as  a  positive 
state  of  the  bundle.   The  stimulation  of  <  AN  lines  is 
considered  as  a  negative  state.   Any  other  number  of  stimulated 
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line  is  interpreted  as  a  malfunction.   By  constructing  the 
automaton  appropriately,  it  can  be  shown  that  the  number 
of  lines  deviating  from  the  "correctly  functioning" 
majorities  of  their  bundles  may  be  kept  at  or  below  the 
critical  level  A  N  (with  arbitrarily  high  probability) . 

J.  von  Neumann  called  such  a  system  of  construction  "multi- 

„  (30) 
plexing" . 


a 

b 
c 


Each  group  =  represents 
a  bundle  of  N  lines. 


Fig.  3.1  Automaton  as  A  Black  Box 


The  technique  of  multiplexing  requires  that  the  comp- 
lete system  must  be  organized  in  such  a  manner,  that  a 
malfunction  of  the  entire  automaton  cannot  be  caused  by  the 
malfunctioning  of  a  single  component,  or  of  a  small  number 
of  components,  but  only  by  the  malfunctioning  of  a  large 
number  of  them.   As  the  reader  may  observe,  the  probability  of 
such  occurrence  can  be  made  arbitrarily  small  provided  the 
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number  of  lines  in  each  bundle  is  made  sufficiently  large. 

D.    Von  Neumann's  Majority  Organ 

1 .    The  Basic  Executive  Organ 

The  criterion  that  a  control  system  fails  only 
if  the  majority  of  the  inputs  malfunction  led  to  the 
invention  of  the  majority  organ  by  von  Neumann  in  1952. 
The  majority  organ  will  be  able  to  handle,  bundle  of 
inputs  and  outputs  as  well  as  single  lines.   For  the 
sake  of  simplicity,  however,  the  majority  organ  will  be 
modelled  as  a  black  box  with  three  single  line  inputs 
a,  b,  and  c  of  similar  characteristics,  as  shown  in 
Fig.  3.2. 
m(a,b,c)  =  ab  +  ac  +  be  =  (a+b)  (a+c)  (b+c)     (3.1) 

The  Majority  Organ 


a 


b  K  m   ) m(a.b.c) 


Fig.  3.2 

Here  m(a,b,c)  represents  the  majority  of  the  input  signals 

a,  b,  and  c;  ab  denotes  a  and  b,  whereas  a+b  defines  a 

or  b.   Using  the  majority  organ,  it  is  clear  that  if  any 
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two  of  the  three  inputs  are  stimulated,  the  output 
will  be  stimulated.   Similarly,  if  any  two  of  the  inputs 
are  not  stimulated,  the  mechanism  will  not  stimulate 
any  output  at  all. 

Thus,  it  appears  that  the  majority  organ  can  also 
be  called  the  basic  executive  organ  because  it  executes 
the  desired  basic  operations  on  the  bundles.   After  the 
execution,  however,  the  degradation  caused  by  the 
executive  organ  must  be  erased;  moreover,  the  stimulation 
level  of  the  inputs  has  to  be  restored.   These  two  require- 
ments necessitate  the  creation  of  a  second  organ  the 

restoring  organ. 
2.    The  Restoring  Organ 
a.   Construction 

The  restoring  organ  can  be  constructed  with 
little  difficulties  and  in  fact,  the  ordinary  major- 
ity organ  already  performs  this  task  in  a  crude  way. 
If  one  considers  the  simple  case  of  having  three 
signals  at  the  input  like  that  shown  in  Fig.  3.2, 
it  should  be  obvious  to  the  reader  that  the  major- 
ity organ  suppresses  a  single  incoming  impulse  as 
well  as  a  single  incoming  non-impulse.   In  other 
words,  it  amplifies  the  presence  as  well  as  the 
absence  of  the  incoming  impulses. 

Before  continuing  any  further,  one  note  of 
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importance  that  should  be  emphasized  here  is  the 
following:   In  order  to  apply  the  theories  of 
probability  and  statistics  to  the  majority  organ 
concept  in  various  applications,  all  inputs  must 
be  considered  as  statistically  independent. 

What  are  the  advantages  of  multiplexing?   As 
mentioned  earlier,  the  most  desirable  feature  of 
a  multiplexed  system  is  its  ability  to  control 
errors.   It  can  be  shown  by  statistical  analysis 
that,  by  using  large  enough  bundles  of  lines  (N 
being  the  size  of  the  bundle),  any  desired  degree 
of  accuracy  can  be  obtained  with  a  multiplexed 
automaton.   Of  course,  economics  and  implement- 
ation difficulties  may  dictate  the  largest  num- 
ber that  N  can  take  on. 
b .   Numerical  Evaluation 

Does  the  majority  organ  really  perform 
the  task  of  a  restoring  organ?   The  following 
evaluation  will  attempt  to  prove  just  that. 

If  there  are  N  incoming  lines  and  oC   N  of 
them  are  stimulated,  then  the  probability  of  any 
majority  organ  being  stimulated  is 

cC*    =    3oC2  -  2o63  .  (3.2) 

Provided  N  is  large,  approximately  cC    N  outputs 
will  be  stimulated.   A  curve  of  oC      against  06 
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is  plotted  in  Fig.  3.3. 


Numerical  Evaluation  of 
the  Majority  Organ 


>•  oC 


Fig.  3.3 


The  curve  intersects  the  diagonal  oC      =  06  three 
times,  at  oC    =  0,  VZi    and  1.   For  0  <  oC    <    Vz ,  the 
curve  indicates  0  <  cC     <  oC  ;  for  Vz    <    oC  <  1, 
the  plot  shows  that  oC  <  oC  <  1 .   In  fact,  suc- 
cessive  iteration  of  this  process  converges  oC 
to  the  asymptote  at  0  if  the  original  oC  <  Yz   and 
to  the  asymptote  at  1  if  the  initial  cC    >    Vz.      This 
is  precisely  the  process  of  restoration  for  a  digital 
system,  to  bring  oC   nearer  to  either  0  or  1,  to  which 
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it  was  nearer  originally.   Thus  it  is  shown  that 
the  majority  organ  does  possess  the  desired 
characteristics  of  a  restoring  element. 

E .    Majority  Organ  Operations  in  a  Digital  System 

Professor  H.  M.  Paynter  of  M.  I.  T.  went  one 

step  further  to  develop  the  AND  and  OR  logic  elements  in 

(33) 
more  detail.       In  digital  or  binary  logic,  the  output 

can  only  take  on  the  value  of  either  0  or  1.   As  in  set 
theory,  one  can  represent  the  AND  operator  with  the  inter- 
section symbol  A  ,  and  the  OR  operator  with  the  union 

u  i  n,   (34) 

symbol  V  . 

If  there  are  two  independent  variables  X  and  X„ ,  then 
the  operations  of  union  and  intersection  may  be  represented 
in  the  functional  matrix  form  as  shov/n  in  Fig.  3.4. 

Operations  of  Union  &  Intersection 


X. 


X, 


I   x2 

0 

1 

0 

0 

1 

1 

1 

1 

X, 


\  x2 

0 

1 

0 

0 

0 

1 

0 

1 

Fig.  3.4 
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The  reader  might  notice  the  similarity  between  the 
above  matrix  and  a  conventional  truth  table.   In  fact,  if 
the  symbols  T  (truth)  and  F  (falsity)  are  substituted  for 
1  and  0,  respectively,  a  truth  table  v/ould  have  been  con- 
structed. 

If  the  inputs  are  3-bit  binary  words,  the  operations 
of  union  and  intersection  produce  some  fairly  interesting 
results.   For  example,  if  X.  =  Oil  (3  in  base  10)  and 
X9  =  100  (4  in  base  10),  then  the  operations  of  V  and  A 
may  be  represented  in  Fig.  3.5. 


x1  v  x2  x1  A  x2 


10  0  Oil 


X-  =  0  1  1 


x2  =  1  0  0 


Union  &  Intersection  of  a  Binary  word 

Fig.  3.5 

The  results  in  Fig.  3.5  indicate  that  the  operation  of 
union  produces  the  larger  of  the  two  3-bit  words,  whereas  the 
operation  of  intersection  yields  the  smaller  of  the  two  words. 
This  concept  will  be  developed  further  when  continuum  logic  is 
discussed. 
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F.    Multi-valued  Logic 

One  may  conceive  a  spectrum  of  multi-valued  or 
n-valued  logics  with  binary  and  continuum  logics  occupying 

the  extreme  positions.   This  concept  was  first  introduced 

(35) 
by  H.  Reichenbach      in  1932,  then  evaluated  further  by 

P.  C.  Rosenbloorrr   ;  in  1950.   It  was  not  until  1960, 

however,  that  the  idea  of  multi-valued  logics  was  linked  to 

the  study  of  control  systems  by  H.  M.  Paynter. 

In  two  valued  logic,  absolute  falsity  is  designated  by 

the  value  0,  whereas  absolute  truth  is  assigned  the  value  of 

1.   On  this  line  of  continuum  logic,  any  other  values  that 

lie  between  0  and  1  may  be  interpreted  as  "partial  truth" 

as  proposed  by  Paynter.   In  a  four  valued  logic,  for  example, 

the  truth  values  might  be  viewed  as  "truth",  "plausibility", 

"implausibility" ,  and  "falsity". 

(37) 
In  the  system  proposed  by  E.  L.  Post,      there  are  n 

truth  values  which  may  be  denoted  by  1,2,3,...,  (n-1),  and 

n.   The  operation  of  the  intersection  A  can  be  defined  by 

the  matrix  shown  in  Fig.  3.6. 

This  logic  of  propositions  for  the  case  of  multi-valued 

logics  is  known  as  Post  algebra,  as  opposed  to  the  Boolean 

algebra  for  the  two  valued  case. 
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Post  Logics 


Fie;.  3.6 


G.    Analogy  Among  Binary,  Multi-valued,  and  Continuous  Logics 

Binary  logic  can  be  defined  as  discrete  logic,  one 
that  consists  of  only  O's  and  l's.   A  three-valued  logic  is 
composed  of  O's,  )£'s,  and  l's.   On  the  other  hand,  an  analog 
logic  or  continuous  logic  can  take  on  infinitely  many  values 

between  0  and  1.   Fig.  3.7  shows  undeniable  similarities 

( 38  ) 
among  binary,  three-valued,  and  continuous  logics.    ; 
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Z  =  V (x,y) 


Binary 


3-valued 


(O.O'* 


(0,0) 


Continuous 


Fig.  3.7  a 


Fig.  3.7   Similaries  Among  Different  Logics 
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Z  =  A  (x,y) 


Binary 


Co,i) 


(0.0) 


3-valued 


Continuous 


Fig.  3.7  b 


Fig.  3.7   Similaries  Among  Different  Logics 
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An  analog  analogy  of  the  majority  organ  as  first  pro- 
posed by  H.  M.  Paynter  will  be  presented  later  in  this 
chapter. 

H.    From  Digital  to  Analog  via  Multi-valued  Post  Logics 

Since  the  concept  of  multiplexing  and  the  prin- 
ciple of  the  majority  organ  were  first  introduced  by  von 
Neumann,  a  great  deal  of  contributions  has  been  made  by 
others  in  the  area  of  reliability  of  binary  system  com- 
posed by  subsystems  interconnected  in  various  ways  by 
different  kinds  of  restoring  elements.   However,  primary 
signals  from  many  instrumentation,  control,  and  communi- 
cation systems  are  still  in  a  continuous  or  analog  form. 
It  is  true  that  much  of  the  work  dealing  with  redundant 
digital  systems  can  be  carried  over  to  analog  systems,  but 
the  unique  characteristics  of  a  continuous  analog  signal 
necessitate  a  separate  study. 

Unlike  the  simplicity  of  a  digital  system  with  its 
strings  of  0 ' s  and  l's,  or  the  multi-valued  system  with 
its  finite  set  of  values,  an  analog  signal  is  much  more 
complex  with  its  infinitely  many  forms  and  values.   It 
was  Paynter  who  first  formulated  an  analogy  between  digital 
restoring  elements  and  the  upper  and  lower  selectors  used 
in  an  analog  system. 
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I .    Continuum  Logic 

In  the  world  of  digital  O's  and  l's,  von  Neumann 

used  the  AND  and  OR  organs  as  the  two  building  blocks  for 

his  majority  organ.   Similarly,  H.  M.  Paynter  uses  the 

upper  and  lower  selectors  to  construct  his  median-taking 

(33) 
element  for  an  analog  system.       Paynter  defines  the 

union  operator  V  as  the  upper  selector: 

V  X(k)  =  X(k    )  (3.3) 

max 

and  the  intersection  A  as  the  lower  selector: 

A  X(k)  =  X(k  .  )  (3.4) 

mm 

where  (x(k)}  is  defined  as  an  aggregate  of  classes  such 
k  =  1,2,3,-.  ..,n.   Fig.  3.8  shows  the  upper  and 

lower  selectors  in  symbols. 

If  X  represents  a  group  of  time-varying  functions, 

the  following  will  hold  true: 

X  =  X(t)  =   {^(t)   k  =  1,2,3,.. .,n}  (3.5) 

If  the  upper  and  lower  selector  operators  are  now 

performed  on  a  set  of  signals  as  shown  in  Fig.  3.9, 
V  {x(t)}  will  represent  the  greatest  of  the  X  at  time 

t,  whereas   A  {x(t)}  will  depict  the  least. 

J.    Operations  of  the  Majority  Organ  in  an  Analog  System 
As  suggested  in  section  D  of  this  chapter,  the 

majority  organ  can  be  represented  in  the  following  Boolean 

-i  4-s    u-    (38) 
relationships: 


that   X, 
k 
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PVt  (X1,X2,X3)  =  (X1AX2)  V  (X1AX3)  V  (X2AX3) 

=  (x1vx2)  A  (x1vx3)  A  (x2VX3) 
In  symbols,  these  relationships  are  modelled  in  the 
configurations  shown  in  Fig.  3.10. 


Selection  as  a  Process 


Upper  Selector 


n 

INPUT     {    " 
SIGNALS 


x,m^ 

V 

X*«)  r 

^tt>-  V%K(t) 

— ►    ' 

3V« 

Lower  Selector 


n 

SIGNALS 


X<(t\ 


/NPUT    {   X](  ^ 


X»tt^ 


^ft)»AX),w 


Fig.    3.8 
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Operations   of   the   Upper  and  Lower   Selectors 


A{xw}-/ 


X 


Fig.    3.9 


If  X.(t),  Xp(t),  and  X  (t)  represent  three  similar 
sinusoidal  signals  but  saturated  with  different  noise  and 
distortion  like  that  shown  in  Fig.  3.11,  then  M  (X1,X  ,X3) 
actually  takes  on  the  median  value  at  any  time  t.   Using 

the  same  symbols  as  shown  in  Fig.  3.11,  y  represents  a 

..  (38) 

continuous  median  signal. 

In  chapter  4,  averaging  and  voting,  the  two  multi- 
plexing techniques  that  are  most  widely  used,  will  be 
discussed  in  detail. 
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Selection  of  Continuous  Median  Signal 
Special  Case  of  Three  Signals 


Fig.  3.11 
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CHAPTER  IV 
AVERAGING,  MEDIATING,  AND  OTHER  VOTING  SYSTEMS 

A.    A  Need  for  Redundancy 

A  control  system  needs  to  be  monitored  on  a  con- 
tinuous basis;  but  if  the  instruments  that  monitor  the 
system  performance  are  themselves  not  completely  reliable, 
then  the  system  reliability  is  jeopardized.   The  control 
system  must  act  on  the  basis  of  signals  transmitted  from 
the  measuring  instruments.   If,  however,  these  signals  are 
faulty  or  inaccurate,  then  the  system  can  no  longer  achieve 
optimal  or  even  safe  operation. 

The  importance  of  redundant  instruments  in  a  control 
system  cannot  be  overemphasized.   As  already  mentioned  in 
chapter  1,  if  only  one  instrument  is  used  to  monitor  a 
critical  parameter,  the  failure  of  that  instrument  could 
often  lead  to  catastrophe. 

Obviously,  if  a  second  instrument  is  installed  to 
monitor  the  same  parameter,  the  probability  of  system 
failure  is  considerably  decreased.   For  example,  if  an 
averager  is  used  to  process  the  signals  from  two  redun- 
dant instruments,  the  output  is  clearly  more  reliable  than 
the  output  from  a  single  sensor.   The  difficulty  arises, 
however,  when  the  two  transducer  signals  are  vastly  different 
from  each  other.   Here  the  dilemma  leads  to  the  following 

question:   Which  signal  should  one  choose?   In  addition, 
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even  when  the  faulty  instrument  is  identified,  a  doubly 
redundant  system  does  not  allow  for  hot-repair. 

Here,  the  advantages  of  a  triply  redundant  instru- 
mentation system  become  highly  significant.   In  the 
technique  of  averaging,  with  one  signal  going  astray,  the 
output  is  only  slightly  in  error.   In  the  method  of  voting, 
however,  as  long  as  only  one  signal  is  erroneous,  the  out- 
put remains  correct.   Furthermore,  even  when  two  signals 
have  failed,  but  if  one  failed  high  while  a  second  one 
failed  low,  the  output  still  maintained  a  correct  value. 
And  finally,  in  view  of  the  tremendous  economic  penalty  for 
downtime,  the  fact  that  voting  allows  for  hot-repair  of  a 
faulty  instrument  makes  it  especially  attractive  for  a 
thermal  power  system. 

The  reader  will  learn  more  about  a  triply  redundant 
instrumentation  system  in  the  paragraphs  to  follow. 

B.    Transition  from  Digital  to  Analog  to  Digital 

John  von  Neumann's  majority  organ  for  a  binary 
system  was  first  introduced  in  chapter  3.   In  a  binary 
system,  as  already  illustrated  in  the  last  chapter,  the 
input  and  output  signals  can  be  easily  represented  by 
strings  of  0 ' s  and  l's.   The  majority-vote  logic  element 
can  be  constructed  with  a  combination  of  two  basic 

elements  AND  and  OR  gates.   In  fact,  it  is  a  relatively 

straightforward  task  to  demonstrate  the  operations  of  the 
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majority  organ  in  a  binary  system,  as  already  done  in  chapter 
3  for  a  simple  case. 

Since  the  majority-vote  logic  was  first  introduced  by 
von  Neumann  in  his  series  of  lectures  at  Caltech  (California 
Institute  of  Technology)  in  1952,      a  tremendous  amount  of 
works,  both  theoretical  and  experimental,  has  been  conducted 
in  the  1960 's  and  1970' s  to  evaluate  the  reliability  of 
digital  systems  using  redundancy.   It  was  in  1958,  only  6 
years  after  von  Neumann  presented  his  majority  logic  concept, 
Paynter  formulated  an  analogy  between  digital  restoring 

elements  and  the  upper  and  lower  selectors  used  in  an  analog 

(33) 

system.       As  mentioned  in  chapter  3,  the  unique  character- 
istics of  analog  signals  from  most  instrumentation  make  it 
necessary  to  conduct  a  separate  study  to  analyze  the  appli- 
cation of  mediation  to  an  analog  system.   The  experimental 
work  conducted  by  Karnopp  and  Bender  in  1966  verified  the 

advantages  that  one  would  gain  in  the  utilization  of  averaging 

(2) 
and  mediation  in  an  analog  system. 

A  symposium  on  digital  redundancy  in  1962  may  very  well 

have  started  the  transition  from  analog  to  digital  with  full 

speed.   In  February,  1962,  a  two  day  symposium  was  held  in 

Washington,  D.C.  on  Redundancy  Techniques  for  Computing 

(39) 
Systems      in  which  a  total  of  more  than  20  papers  were 

presented  by  various  design  engineers  and  mathematicians. 

The  collection  of  papers  was  fabulous;  it  represented  the 
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hard  work  and  dedication  of  numerous  distinguished  people. 

With  the  advent  of  digital  technology  in  the  1960  "s, 
digital  redundancy  using  the  voting  technique  began  to  be 
found  in  various  applications.   The  idea  of  a  voting  cir- 
cuitry is  not  new,  but  its  implementation  in  the  industries 
has  definitely  been  an  area  full  of  innovations.   During 
the  past  few  years  in  particular,  industrial  implementations 
of  redundancy  are  becoming  more  and  more  common  everyday. 
Among  some  of  the  more  prominent  examples  are  the  Space 
Shuttle  program,  the  strapdown  redundant  inertial  instruments 
for  military  ballistic  missiles,      and  the  Bell  System 
Electronic  Switching  Systems  (ESS).       In  fact,  reports 
in  this  area  have  appeared  on  a  regular  basis  in  journals 
such  as  the  IEEE  Proceedings,  AIAA  Guidance  and  Control 
Conference  Transactions,  Electronics,  etc. 

C .    Averaging  Multiplexing  Technique 
1.    Introduction 

The  averaging  method  can  be  considered  as 
one  of  the  oldest  yet  extremely  useful  techniques  to 
improve  the  reliability  of  a  signal  or  data.   One  is 
familiar  with  the  situation  in  which  a  photographer 
takes  two  or  three  spot  readings  with  his  light  meter, 
then  uses  the  average  of  the  readings  to  set  the 
aperture  and  shutter  speed  on  his  camera. 

A  straightforward  averaging  technique  involves 
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simply  taking  the  arithmetic  mean  of  a  series  of  readings; 
in  other  words ,  the  weight  factor  is  equal  for  all  channels 
This  operation,  performed  by  a  device  to  be  called  an 
averager,  reduces  the  failure  rate  of  the  measuring  system 
according  to  the  total  number  of  sensors.   However, 
noise  or  error  in  any  one  of  the  inputs  still  affects 
the  averaging  output.   If  one  knows  a  priori  that  a 
certain  channel  is  more  reliable  than  others,  then  a 

heavier  weight  factor  can  be  assigned  to  that  channel, 

(42) 
thus  increasing  the  overall  reliability. 

An  even  more  elaborate  "average"  method  is  also 

available  as  a  multiplexing  technique.   Here  the  word 

"average"  is  in  parenthesis  because  this  method  resembles 

the  voting  technique  more  than  the  ordinary  averaging 

method.   In  this  methodology,  weight  factors  for  each 

channel  are  continuously  changing  based  on  cross-channel 

(43 ) 
differences  among  the  several  channels.       More  on  this 

method  later  in  this  chapter. 

2.    Functional  Block  Diagram 

A  typical  multiplexed  system  can  be  represented 

by  means  of  a  block  diagram  like  that  shown  in  Fig.  4.1. 

Here  the  actual  multiplexing  technique  can  be  averaging, 

vote-taking,  or  something  more  complex.   The  physical 

variable  can  be  temperature,  pressure,  or  any  other 

engineering  parameter.   The  noise  at  each  channel  may 
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be  one  of  the  following  types:   transmitted  noise,  in- 
herent noise,  or  induced  noise.   The  block  diagram 
represents  a  triply  redundant  case. 
3 .    Principles  of  Operations 

An  averager  which  takes  a  linear  combination  of 

(42) 
its  inputs  to  form  its  output  is  shown  in  Fig.  4.2. 

Once  again,  a  triply  redundant  case  is  presented  here; 

obviously,  one  may  extend  the  technique  for  higher  order 

redundant  systems.   Here  the  three  input  signals  are 

assumed  to  be  identical,  but  with  different  noise  levels 

superimposed  on  them.   As  mentioned  earlier,  if  the 

weight  factors,  a. ,  ap,  and  a.  all  have  the  value  of 

1/3,  then  the  output  simply  will  be  the  arithmetic  mean 

of  the  input  signals.   If  we  designate  the  output  as 

X   . ,  then  the  output  of  the  averager  is  given  by  the 

OUT:  '  ^  co         a         j' 

relation: 

1   * 

X   ,   —  ^r   /  .   X__ 

out    3  ^   n 
which  can  be  generalized  to  any  number  of  signals. 

One  of  the  limitations  of  a  straightforward  averaging 

method  is  that  a  number  of  consistently  unreliable  channels 

may  degrade  the  quality  of  the  output.   This  limitation 

may  be  overcome,  however,  if  the  reliable  inputs  are 

given  heavier  weight  factors  and  the  unreliable  inputs  are 

given  lighter  weight  factors.   Clearly,  the  reliability 

of  such  tailormade  system  must  be  determined  on  an 
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individual  basis. 

4.  Reliability  Calculations 

In  the  averaging  method,  the  output  will  be 
somewhat  faulty  if  any  one  or  more  of  the  inputs  is 
faulty.   It  is  clear  that  the  probability  of  a  faulty 
output  is  higher  than  the  probability  of  failure  at 
any  individual  channel.   This  shows  that  if  the  control 
system  requires  that  the  output  must  always  be  exactly 
correct,  then  the  averaging  method  may  not  be  the 
optimal  choice  due  to  its  high  failure  probability. 
Nevertheless,  one  must  keep  in  mind  that  the  averager 
output  signal  will  not  deviate  as  much  as  a  single 
signal.   Detailed  reliability  calculations  and  analysis 
for  the  averager  will  be  performed  in  section  F,  along 
with  those  of  the  voting  element  for  ease  of  comparison 

5.  Experimental  Verification 
a.   Statistical  Analysis 

An  experiment  was  conducted  by  dePian  and 

Grisamore  to  show  the  advantages  of  an  averaging 

-4.  (44) 
circuit  over  a  non-averaging  single  circuit. 

A  distribution  of  output  values  was  obtained  by 

applying  the  same  input  signal  to  both  the 

averaging  and  the  non-averaging  circuits.   After 

elaborate  manipulation  of  the  output  data,  the 

following  relations  were  found: 


-  74  - 

For  the  non-averaging  circuit  (139  samples) 
C  =    0.075 
x  =  0.174 

For  the  averaging  circuit  (44  samples) 
a   =  0.025 
x  =  0.187 
The  distribution  curves  for  the  two  types  of 
circuits  are  shown  in  Fig.  4.3.   As  one  can  inter- 
pret from  the  plot  of  normalized  distribution  of 
output  signals  (x)  in  Fig.  4.3,  the  average  circuit 
has  a  considerably  smaller  standard  deviation.   It 
can  be  concluded  that  in  general,  the  averaging 
technique  provides  more  reliable  output  signals, 
b .   Output  Waveforms 

The  improvement  in  signal  quality  of  an 
averager  output  can  be  best  seen  from  a  set  of 
analog  signals.   Time  plots  of  three  noisy  input 

signals  and  the  resulting  output  are  shown  in 

(45) 
Fig.  4.4.       When  only  one  input  is  noisy, 

the  averager  output  has  the  same  noise  function 

as  the  input,  but  reduced  to  one-third. 

If  two  of  the  input  signals  are  noisy,  the 

output  noise  level  depends  on  the  amount  of 

correlation  between  the  noisy  functions  on  each 
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input.  l/hen  all  three  inputs  are  noisy,  the  out- 
put noise  levels  increase  but  are  still  less  than 
those  of  any  of  the  inputs. 


Normalized  distribution  of  output  signals  (x) 
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Averager  Output 
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Fig.  4.4 

Experimental  time  plots  of  averager  output  when 
one,  two,  or  three  input  signals  are  noisy.   In 
each  case  the  upper  three  signals  are  the  inputs 
and  the  lower  signal  is  the  output. 
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D.    Voting  Technique 


1.    Introduction 


A  vote-taker  is  a  generalization  of  the 
majority  organ  introduced  by  von  Neumann.   The  output 
of  a  voter  will  always  be  the  median  value  of  the 
inputs.   Voting  operations  in  an  analog  system  have 
already  been  performed  in  chapter  3.   The  operations 
of  a  voter  circuitry  on  three  3-bit  digital  words 
will  be  conducted  later  in  this  section. 
2.    Implementation 

As  already  stated  in  the  last  chapter,  the 

voting  concept  can  be  defined,  in  terms  of  Eoolean 

( 38 ) 
algebra,  as  the  following  relations: 

M(^1,X2,X3)  =  (X1V  X2}  A  (X1V  X3}  A  (X2  V  X3}   (4,1) 
where  X1 ,  Xp,  and  X„  are  digital  input  signals. 

The  above  concept  can  be  easily  implemented  using 
the  voter  circuitry  shown  in  Fig.  4.5.   The  circuit, 
in  essence,  produces  an  output  which  remains  correct 
no  matter  in  what  manner  a  single  channel  fails. 

Critics  of  the  voting  principle  often  ask  the 
following  question:   How  does  the  failure  rate  of  the 
voter  affect  the  overall  probability  of  error  in  a 
system?   Obviously,  if  the  voter  is  constructed  of  the 
same  components  as  used  in  the  rest  of  the  system,  no 
improvement  occurs.   The  next  step  is  to  consider  using 
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Fig.  4.5  Voter  Circuitry 


extremely  reliable  parts  for  the  voter.   This  in  turn 
is  followed  by  the  suggestion  that  one  should  use  these 
extremely  reliable  parts  for  the  rest  of  the  system, 
thereby  creating  the  original  condition  with  no  increase 
in  reliability  over  the  non-redundant  case.   The  last 
suggestion  is  highly  impractical,  however,  because 
complexities  of  modern  circuitries  and  economic  con- 
siderations often  prohibit  the  use  of  ultra  reliable 
components  throughout  the  entire  system. 

Therefore,  it  can  be  concluded  that  if  only  the 
voting  circuitries  are  made  of  highly  reliable  components, 
the  overall  system  reliability  will  still  improve. 
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A  detailed  calculation  of  the  improved  reliability 
will  be  presented  in  the  next  section. 

One  must  realize  that  the  voter  in  Fig.  4.5  is 
only  a  1-bit  machine.   It  is  true  that  in  this  thesis 
all  signals  are  assumed  to  be  16-bit  parallel  words; 
but  a  16-bit  parallel  v/ord  voting  circuitry  will  take 
up  several  pages  of  circuit  diagrams.   In  order  to 
provide  the  reader  with  the  perception  of  what  a 
16-bit  vote-taker  v/ould  look  like,  however,  a  simpler 
3-bit  voter  is  shown  in  Fig.  4.6. 

In  Fig.  4.6  the  binary  v/ords  Oil,  100,  and  101 
are  used  to  illustrate  the  operations  of  such  3-bit 
voter.   The  purpose  of  the  comparator  is  to  assist 
the  three  OR  gates  to  find  the  larger  of  any  two 
3-bit  words.   As  soon  as  any  two  bits  have  different 
values,  the  comparator  will  identify  which  bit  has 
a  value  of  1,  then  command  the  converters  to  convert 
the  rest  of  the  3  bits  of  the  smaller  binary  word  to 
have  the  same  values  as  those  of  the  larger  binary 
word.   In  this  way,  the  output  at  the  OR  gates  will 
always  be  the  larger  of  the  two  3-bit  words.   The 
key  to  Fig.  4.6  provides  an  example  for  such  operations. 

If  one  compares  the  three  inputs  with  the  output  bit 
by  bit,  he  v/ould  notice  that  the  output  bits  do  not 
represent  the  majority  of  the  input  bits.   For  example, 
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KEY  to  Fig.  4.6 
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Operations  of  COMPARATOR  at  point   A  ,  1 —  comparator  in 

top  voter  (other  comparators  operate  in  similar  fashion) : 

1.    If  X-  -  jt  Xp  1  ,  identify  which  is  larger,  otherwise 

no  action  taken. 

1  >  X0   1  ,  command  converters  to  convert  X9  0 

to  have  same  value  as  X.  9  ;  and  convert  X0  q  to  have 

1  ,  d  d.  ,  o 

same  value  as  X..  Q  . 
b.   If  Xp  1  >  X1  1  ,  command  converters  to  convert  X 
to  have  same  value  as  X.  „  ;  and  convert  X1  _  to 
have  same  value  as  X0    «  . 

INPUTS  OUTPUT 

10  1 

110  110      (Median  Value) 

111 
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the  most  significant  bit  on  the  output  does  not  represent 
the  majority  of  the  most  significant  bits  on  the  three 
inputs.   The  reader  may  have  noticed,  however,  that  the 
output  represents  the  median  value  of  the  three  inputs. 
Other  examples  performed  by  the  author  show  similar 
results.   In  this  regard,  the  voter  in  a  digital  system 
is  identical  to  the  mediator  used  in  an  analog  system, 
as  discussed  in  chapter  3. 
3 .    Reliability  and  Maintainability 

Here  the  reliability  study  is  conducted  for 
both  the  averaging  and  the  voting  techniques  for 
comparison.   One  of  the  major  advantages  of  the  voting 
concept  is  that  it  does  not  require  any  failure 
detection.   Failure  detection,  on  the  other  hand,  is 
essential  for  some  fault-tolerant  systems  that  use  a 
tolerance  renewal  scheme  to  reconfigure  the  system 
around  a  faulty  module  using  spare  units,  once  the 
failed  module  has  been  isolated. 

When  a  channel  fails  by  outputing  a  faulty  signal, 
it  is  sometimes  not  easy  to  determine  the  exact  cause 
of  the  fault;  it  can  be  a  short  or  an  open  circuit, 
or  a  limit  value  such  as  a  supply  voltage.   As  long  as 
only  a  single  channel  has  failed,  there  will  be  no 
effect  on  the  output  signal  (for  a  triply  redundant 
case).   Moreover,  monitoring  equipment  can  be  set  up 
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to  pinpoint  the  faulty  channel  when  a  particular  signal 
deviates  from  the  other  two.   Once  the  faulty  channel 
is  located,  it  can  be  serviced  on  line  without  affecting 
the  overall  operation  of  the  control  system,  provided 
only  that  a  second  channel  does  not  fail  during  the 
service  period.   As  long  as  maintenance  is  available  to 
replace  the  faulty  unit,  the  probability  of  continuous 
failure-free  service  is  greatly  increased. 

In  this  reliability  analysis,  all  input  signals  are 
considered  to  be  noise-free,  but  to  have  the  possibility 
of  being  at  false  value.   A  false  value  at  the  input  is 
defined  as  a  failure  of  an  input  signal.   A  clear  defini- 
tion of  an  output  failure  is  not  established;  instead, 
the  probability  that  at  least  one,  two,  or  three  input 
signals  have  failed  will  be  plotted  as  a  function  of 
individual  signal  failure  probability. 

The  probability  that  at  least  f  out  of  3  inputs 
fail,  Pr(f),  is  the  probability  that  f,  f-1,  etc.  signals 

fail;  based  on  the  binomial  expansion  theorem,  Pr(f) 

(45  46) 

can  then  be  defined  as  follows:    ' 

Pr(f)  =  Z    2J p1  (i-p)3"1         (4.2) 

i=f      (3-i)!  i! 

where  P  is  the  probability  of  an  individual  input 
failure. 
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Probability  that  at  least  (1),  (2)  or  (3) 
signals  are  faulty  vs.  individual  signal 
failure  probability 


In  Fig.  4.7  the  probability,  Pr(f),  that  at  least 
f  of  3  channels  fail  is  plotted  against  the  constant 
probability,  P,  that  any  one  of  the  signals  may  be  faulty 
for  f  =  1,  2,  3.   From  this  graph,  one  can  obtain  an 

indication  of  the  failure  probabilities  for  the  averaging 

(45) 
and  the  vote-taking  techniques. 

Curve  1  applies  only  to  the  averager  since  one  of 

three  channels  fails  for  the  voter  has  no  effect  on  the 

output.   For  the  averager,  however,  the  output  will  be 
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faulty  if  any  one  of  the  inputs  is  faulty.   Curve  1 
indicates  that  the  probability  of  a  faulty  output  of 
an  averager  is  worse  than  the  probability  of  failure  at 
any  single  channel.   Of  course,  the  averager  output 
signal  will  not  deviate  as  much  as  an  individual  signal. 

Curve  2  of  Fig.  4.7  represents  the  case  of  the 
vote-taker  in  which  a  faulty  output  will  result  whenever 
any  two  of  its  three  inputs  are  faulty.   If  the  channel 
fails  by  open  circuiting,  however,  the  output  will  not 
be  affected.   From  the  S  shape  of  curve  2,  it  becomes 
quite  clear  that  for  well-designed  channels  with 
P  <<  j£,  the  probability  of  a  faulty  output  for  the 
voter  is  very  small  compared  with  that  for  a  single 
channel . 

Finally,  curve  3  indicates  the  worst  case  when 
all  three  channels  are  faulty.   Until  all  three  inputs 
are  faulty,  an  averager  will  still  react  to  some  extent 
to  the  correct  signal  as  long  as  some  information  from 
the  correct  signal  get  through.   The  voter,  on  the  other 
hand,  will  simply  neglect  the  correct  signal  altogether 
as  soon  as  two  signals  are  faulty. 

Since  the  vote-taker  can  operate  perfectly  with  a 
minority  of  channels  failed,  fast  repair  or  replacement 
of  a  malfunctioned  channel  will  sharply  reduce  the 
probability  of  system  failure.   This  feature  is  especially 
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desirable  in  a  thermal  power  plant  if  one  considers  the 
economic  penalty  associated  with  the  shutdown  of  the 
plant  for  maintenance  of  instrumentation. 

Incidentally,  the  fact  that  a  voter  maintains  a 
correct  output  even  when  a  minority  of  its  channels  are 
faulty  is  a  simple  example  of  fault-masking,  the  ability 
to  prevent  the  fault  from  being  transmitted  further 
downstream.. 
4".    Experimental  Verification 

As  in  the  case  of  the  averager,  it  is  consider- 
ably easier  to  visualize  the  sharp  improvement  in  signal 
quality  of  a  voter  output  from  analog  signals.   Time 

plots  of  three  noisy  input  signals  and  the  voter  output 

(45) 
can  be  seen  in  Fig.  4.8.       When  only  one  input  is 

noisy,  the  voter  output  is  completely  clean. 

If  two  of  the  input  signals  are  noisy,  the  output 
noise  level  is  directly  related  to  the.  amount  of 
correlation  between  the  noise  functions  on  each  input. 
Careful  examination  of  the  output  shows  that  the 
output  waveform  is  identical  with  the  noise-free  signal 
for  one-third  of  the  time. 

Finally,  when  all  three  inputs  are  noisy,  the 
output  noise  levels  increase,  but  similar  to  the  averaging 
technique,  the  noise  levels  are  still  less  than  those  of 
the  inputs. 
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Fig.  4.8 

Experimental  time  plots  of  voter  outputs  when  one, 
two,  or  three  input  signals  are  noisy.   In  each 
case  the  upper  three  signals  are  the  inputs  and 
the  lower  signal  is  the  output. 
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5 .  Reliability  for  Higher  Order  Redundancy 

The  triply  redundant  case  has  been  used 
throughout  the  analysis.   One  must  realize  that  higher 
order  of  redundancy  is  also  used.   However,  the  triply 
redundant  case  is  felt  to  be  the  most  practical  case 
because  it  is  the  lowest  order  of  redundancy  to  which 
the  voting  concept  may  be  applied.   Obviously,  one  may 
easily  extend  all  of  the  results  for  higher  order 
redundant  system  in  which  Pr(f)  may  be  represented  by  the 
following  formula: 

Pr(f)  =  £  ^ P1  (l-P)11"1         (4.3) 

i=f       (n-i)!  i! 

where  n  =  order  of  redundancy. 

6 .  Multiple  Line  Restoring  Element 

In  addition  to  the  simple  voter  configuration 
shown  in  Fig.  4.5,  there  are  other  voter  configurations 
that  will  yield  higher  reliability.   Such  an  improved 

version  is  shown  in  Fig.  4.9.   This  arrangement  is 

(47) 
called  the  multiple  line  restoring  element.      It 

consists  of  a  group  of  N  voting  elements,  each  with 

N  inputs.   All  of  the  lines  from  the  input  bundle  enter 

each  of  the  restoring  elements,  M-,  M_,  and  M~  . 

A  more  sophisticated  technique  is  the  triplicated 

voting  method  shown  in  Fig.  4.10.       By  dividing 

each  of  the  parallel  channels  into  a  large  number  of 
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Fig.  4.10   Triplicated  Voting  Technique 
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segments  and  taking  a  vote  after  each  segment,  it  is 
now  possible  for  the  system  to  experience  a  sizable 
number  of  faults  in  all  three  channels  and  still 
perform  satisfactorily,  as  long  as  the  faults  do  not 
occur  simultaneously  in  identical  segments  of  two  out 
of  the  three  channels.   The  number  of  such  segments  in 
a  system  is  referred  to  as  the  "level  of  voting". 

MTBF's  vs.  Levels  of  Voting 
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Fig.  4.11  shows  the  improvement  in  reliability  as  the 
voting  levels  are  increased  in  a  parallel  channel  voter 
system.   Assuming  a  non-redundant  system  with  a  98% 
probability  of  non-failure,  a  three  channel  redundant 
system  with  two  levels  of  voting  should  have  its  MT3F 
(mean  time  between  failure)  increased  by  more  than 
5  times.   Of  course,  the  higher  the  levels  of  voting, 
the  greater  will  be  the  MTBF's,  as  indicated  from 
Fig.  4.11.   One  must  realize,  however,  that  cost  is  an 
important  factor  in  determining  the  maximum  level  of 
voting  that  an  engineer  can  design  a  system. 

E .    Advanced  Voter  Technique 

1 .  Introduction 

In  an  instrumentation  control  system  that 
uses  a  voting  circuitry  like  the  one  examined  in  the 
preceding  section,  whenever  a  channel  fails,  the  output 
will  show  considerable  transient  due  to  the  switching 
action  of  the  voter.   Sometimes,  these  transients 
could  be  severe  enough  to  cause  an  adverse  response  in 
the  total  system.   A  new  voter  has  been  proposed  to 
minimize  such  switching  transients;  the  output  is 

determined  as  a  continuous  smooth  function  of  the 

( 43 ) 
redundant  inputs  using  a  weighted  "average". 

2.  Principles  of  Operations 

This  type  of  voter  minimizes  switching 
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transients  on  the  output  because  the  isolation  of  a 
faulty  channel  is  accomplished  through  a  continuous 
numerical  weighting.   The  output  is  determined  in 
such  a  fashion  that  the  outlying  (faulty)  signals 
are  heavily  discriminated  against,  in  favor  of  the 
signals  that  are  fairly  close. 

In  section  C  the  author  briefly  mentioned  an 
averaging  method  that  assigns  heavier  weight  factors 
to  more  reliable  channels.   These  v/eight  factors, 
however,  were  determined  a  priori.   The  voter  described 
in  this  section,  on  the  other  hand,  uses  weight  factors 

that  are  dynamic  and  are  continuously  changing  based 

(43) 
on  cross-channel  differences. 

A  block  diagram  of  such  voter  is  shown  in  Fig.  4.12 
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Fig.  4.12  Advanced  Voter 
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w1v1  +  w2v2  +  w3v3 

Wl  +  W2  +  W3 


(4.4) 
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Obviously,    if   \L    =    t/0    =    V;"      =    1/3,    then  V       ,     will 

1     2     3  out 

simply  be  a  mean  value  voter,  or  a  simple  averager,  as 
already  examined  in  section  C.   In  any  event,  regardless 
of  what  values  W  ,  W  ,  and  V/   take  on,  V   .  is  always 
a  continuous  smooth  function  of  V- ,  V  ,  and  V  . 

Reference  (43)  provides  a  family  of  v/eight  factors 
for  a  triply  redundant  voter.   Some  weight  factors 
involve  the  exponential  functions,  whereas  others  are 
defined  in  terms  of  the  hyperbolic  functions.   One  group 
of  weight  factors  that  is  of  particular  interest  is  the 
following: 


wi  = 


W   = 
W2 


Wq  = 
o 


1  + 


1  + 


Vl  -  V2 


v2  -  vx 


V3  "  Vl 


Vl  "  V3 


V2  "  V3 


V3  -  V2  \2 


a 


-1 


1  -1 


-1 


(4.5) 


The  constant  a  is  the  tolerance  parameter  which  is 
a  measure  of  the  allowable  noise  level  in  a  given  channel. 

Note  that  if  the  square  of  the  cross-channel 

p 

differences,  (V.  -  V.)  ,  are  all  small,  then  the  eauation 

of  V    will  approach  the  following: 
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f   Vl  "  V2Y 
On  the  other  hand,  if  [ — = =— 1  «  1  and 

/  V   -  V  \2       /  V   -  V  \2 
both  f — - —  j   and  ( — = —J  »  1,  then  the 

V   +  V 

equation  of  V   ,  reduces  to  V     =  . 

out  out 

From  the  above  analysis,  it  becomes  clear  that  if 

V~  is  indeed  the  erroneous  signal,  then  the  weight  factors 

will  computationally  vote  out  Vq  in  favor  of  the  two 

nearly  identical  signals  V-  and  V  .   Table  4.1  can  be 

used  to  demonstrate  just  that.   In  this  table  computed 

values  of  V   ,  for  a  range  of  values  of  V.,  ,  V„,  and  V0 
out  to  1 '   2 '       3 

are  tabulated.   Formulas  used  for  V   ,  and  \L    to  \70 

out       1      3 

are  equations  4.4  and  4.5,  respectively. 

As  the  reader  can  see,  these  weight  factors  are 
constructed  to  discriminate  against  a  possible  failed 
signal  in  favor  of  the  remaining  good  signals.   In  this 
regard,  it  is  similar  to  the  voter  described  in  section 
D. 

F.    Functional  Redundancy 
1.    Introduction 

This  section  deals  with  a  reliability  problem 
that  is  somewhat  different  from  that  of  a  voting  element. 
Here  the  major  concern  is  the  improvement  of  the  overall 
reliability  of  the  entire  system  by  partitioning  the 
system  into  functional  blocks  and  making  each  block 
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INPUTS 

OUTPUT 

Vl 

V2 

V3 

V   . 
out 

0 

0 

0.1 

0.033 

0 

0 

0.5 

0.180 

0 

0 

0.8 

0.210 

0 

0 

1.0 

0.200 

0 

0 

1.2 

0.174 

0 

0 

1.5 

0.114 

0 

0 

2.0 

0.060 

0 

0 

3.0 

0.018 

1.0 

1.0 

1.0 

1.000 

1.0 

1.0 

1.1 

1.033 

1.0 

1.0 

1.2 

1.065 

1.0 

1.0 

1.5 

1.180 

1.0 

1.0 

2.0 

1.200 

1.0 

1.0 

3.0 

1.067 

1.0 

1.0 

4.0 

1.018 

Table  4.1   Voter  Output  for  Triply  Redundant  Signals 
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parallel-redundant . 

2 .    Principles  of  Operations 

The  usual  method  for  improving  the  reliability 
of  a  system  is  to  establish  a  parallel  configuration  of 
two  identical  units,  either  both  operational  or  one 
operational  and  the  other  in  standby.   The  disadvantage 
of  this  arrangement  is  that  the  failure  of  any  one 
component  within  the  unit  would  place  that  entire  unit 
out  of  action. 

If  the  system  is  partitioned  into  functional  blocks, 
and  each  block  is  parallel  redundant,  this  would 
significantly  increase  system  reliability  because  now 

even  if  one  block  in  a  set  fails,  the  other  blocks  in 

(49  ) 
the  set  can  still  be  used.      The  outputs  of  each 

functional  block  are  cross-strapped  to  the  inputs  of 
the  succeeding  pair.   A  block  diagram  of  such  system 
is  shown  in  Fig.  4.13.   The  system  may  be  an  encoder, 
decoder,  or  any  other  functional  device  in  a  control 
scheme . 

With  the  system  partitioned  into  five  parallel- 
redundant  functional  blocks,  it  can  now  be  configured 

5 
into  2  ,  or  32  possible  combinations  of  functions  to 

circumvent  failures  should  they  occur.   Functional 

sections  are  activated  by  power  switching.   With  32 

possible  configurations,  there  is  little  doubt  that 
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Stage  A    Stage  B     Stage  C    Stage  D     Stage  E 

A.  =  Failure  Rate 
Fig.  4.13   Functional  Redundancy 

the  overall  reliability  of  the  system  has  been  greatly 
improved. 


G.    Noise  Reduction 

1 .  Introduction 

Signals  from  various  instruments  are  usually 
superimposed  with  noise.   The  extraneous  noise  may  be 
a  result  of  thermal  emf  from  an  RTD ;  or  it  may  be  caused 
by  self-heating  in  a  thermistor,  to  name  only  two  of  the 
many  sources.   Chapter  2  contains  a  detailed  description 
of  many  of  the  sources  that  can  generate  noise  in  an 
instrumentation  system. 

2.  Noise  Reduction  Methodologies 

Noise  can  be  categorized  into  two  groups: 
random  or  coherent.   Random  noise  is  usually  generated 
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within  components,  such  as  RTDs,  transformer  cores,  or 
semiconductor  junctions,  whereas  coherent  noise  is  either 
locally-generated  by  processes,  such  as  voter  switching, 
or  coupled  in.   Coherent  noise  often  takes  the  form  of 
"spikes" . 

Regardless  of  the  noise  origins,  several  methods 
are  commonly  used  to  retrieve  the  original  waveforms. 
Some  of  these  noise  reduction  techniques  are  analog-to- 
digital  conversion,  shielding  and  guarding,  signal 
compression  and  filtering,  and  where  possible,  an 
information  rate  that  has  enough  redundancy  to  allow 

the  digital  processor  to  retrieve  data  via  correlation 

(9) 
and  summation. 

Where  noise  is  likely  to  have  large  spikes  as  a 

major  component,  the  integrating-type  A/D  converter 

(dual-slope)  usually  provides  additional  filtering. 

For  random  noise,  if  there  are  sufficient  samples  taken 

of  a  given  signal  channel,  the  technique  of  averaging 

may  be  used  as  a  filtering  device. 

3.    Technique  of  Averaging 

Averaging  is  a  noise  reduction  technique 

often  used  in  a  digital  system.   A  digital  averager  is 

basically  a  device  used  for  averaging  repetitive  noisy 

signals.   Signal  averaging  has  the  ability  to  recover 

the  signal's  original  waveshape  from  the  noise.   In 
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this  way,  the  signal-to-noise  ratio  can  be  improved 
by  several  orders  of  magnitude. 

The  author  would  like  to  point  out  that  the  averager 
mentioned  here  is  different  from  the  averaging 
multiplexing  technique  examined  in  section  C.   In 
section  C  the  averager  is  a  device  that  takes  an  average 
value  of  the  signals  from  three  redundant  channels. 
Here,  averaging  is  a  technique  that  reconstructs  a 
signal  waveform  by  taking  the  average  of  a  sufficient 
number  of  repetitive  noisy  signals.   In  this  regard, 
the  averager  described  in  section  C,  in  addition  to 
improve  the  reliability  of  the  signal,  also  acts  as 
a  noise  reduction  device.   Of  course,  the  degree  of 
noise  reduction  is  not  as  extensive  as  compared  to  the 
averager  in  this  section  since  only  three  samples  are 
taken  (in  a  triply  redundant  case). 

Provided  the  waveform  is  repeated  over  and  over 
again,  any  signal  waveform  which  is  corrupted  by  noise 
can  be  reconstructed.   For  a  weak  periodic  signal  that 
is  buried  in  noise,  the  technique  enhances  it  by  over- 
laying successive  segments  of  the  noisy  signal,  where 
the  segment  length  equals  the  period  of  the  signal. 

Even  when  the  waveform  repeats  itself  at  irregular 
intervals,  but  if  some  characteristics  of  the  signal  can 
be  used  to  align  the  successive,  noisy  waveforms,  aver- 


-  100  - 

aging  can  still  be  used.   Fig.  4.14a  and  Fig.  4.14b 
illustrate  such  an  example.   The  signal  in  Fig.  4.14a 
has  a  rather  poor  signal  to  noise  ratio,  but  it  contains 
a  sharp  peak  which  rises  above  the  noise.   By  aligning 
the  peaks  and  then  averaging  the  noisy  waveforms  together, 
the  noise  will  tend  to  cancel  itself  out  whereas  the 
signal  reinforces  itself;  the  result  is  shown  in  Fig. 
4.14b. 

Averaging  An  Aperiodic  Waveform 


Fig.  4.14  a  Fig.  4.14  b 

The  averager  uses  each  new  noisy  signal  to  update 

a  partial  average  formed  from  previous  waveforms,  thus 

forming  a  new  partial  average.   The  sequence  of  events 

can  be  seen  in  Fig.  4.15.   The  symbols  in  Fig.  4.15 

are  defined  as  follow: 

e    is  the  present  noisy  waveform  to  be  averaged 

E    is  a  sampled  and  quantized  version  of  e 

A    is  a  sampled  and  quantized  version  of  the 

present  partial  average  before  it  is  modified 
by  E. 
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Averaging  System  Waveforms 


Time 


E 


A 


Fig.  4.15 
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4.  Low-pass  Filter  for  the  Vote-taker 

It  was  shown  in  the  discussion  in  section  D 
that  the  output  of  a  voter  is  rather  jagged;  the 
switching  action  of  the  voting  circuitry  is  the  cause 
for  this  high  frequency  spectral  content. 

Fig.  4.16a  represents  a  digital  input  with  a  broad 

(2) 
band  noise  spectrum.   '   Note  that  the  abscissa  is  in 

a  log  scale.   Three  input  signals  with  similar  noise 

spectrum  like  that  shown  in  Fig.  4.16a  are  fed  into  a 

voting  multiplexer.   The  output  after  multiplexing 

(Fig.  4.16b)  shows  some  fairly  interesting  effects. 

The  overall  waveform  is  considerably  smoother.   At 

high  frequencies,  however,  substantial  harmonic  contents 

are  still  present. 

In  Fig.  4.17a  a  digital  input  signal  with  a  narrow 
band  noise  spectrum  is  shown.   The  output  after  a  voter 
is  illustrated  in  Fig.  4.17b.   Here,  one  can  see  clearly 
that  there  are  definite  peaks  at  integer  multiples  of 
the  fundamental  frequency. 

In  a  practical  situation  the  signal  spectrum  and 
the  noise  spectrum  often  overlap,  therefore,  considerable 
noise  can  be  filtered  out  by  using  a  simple  low-pass 
RC  filter  like  that  shown  in  Fig.  4.18. 

5.  Buffering  of  Data 

In  the  digital  mode,  one  can  conveniently 
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Broad  Band  Noise 


Fig.  4.16  a 


Fig.  4.16  b 


Narrow  Band  Noise 


Fig.  4.17  a 


Fig.  4.17  b 
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Fig.  4*18   RC  Filter 
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manipulate  the  time  variable  under  various  circumstances. 
After  an  analog  signal  has  been  converted  to  its  digital 
form,  time  is  no  more  constrained  than  any  other  char- 
acteristic of  the  signal.   In  fact,  time  can  be  compressed 
This  process  permits  the  collection  of  data  at  a  slow 
rate  and  the  output  of  this  collected  data  in  a  fast  burst 
For  example,  when  temperature  signals  are  picked  up  by 
an  RTD  over  an  interval  of  a  few  seconds,  they  can  be 
compressed  and  repeatedly  processed  or  displaced  every 
few  milliseconds. 

If  certain  Gaussian  noise  is  always  present  in  a 
particular  frequency  band,  while  the  signal  itself 
spreads  out  in  the  entire  frequency  spectrum,  then  one 
may  wish  to  use  a  band-pass  filter  for  noise  reduction. 
In  digital  telemetry,  in  addition  to  increase  trans- 
mission efficiency,  data  compression  is  often  used  as 
a  technique  to  reduce  noise.   By  using  data  compression, 
the  amount  of  data  to  be  transmitted  is  now  reduced, 
usually  in  the  form  of  redundancy  reduction,  variable- 
length  encoding,  or  parameter  extraction.   If  the 
remaining  important  data  are  reorganized  at  constant 

time  intervals,  a  bandwidth  compression  is  also 

(51  52) 
achieved.    '      Thus,  the  technique  of  data  compression 

is  now  also  acting  as  a  band-pass  filter. 
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6.    Software  Digital  Filters 

Software  digital  filters  refer  to  the  different 
algorithms  that  one  can  use  to  implement  a  filtering 
operation  on  a  general  purpose  digital  computer.   Some 
of  the  better  known  procedures  include  the  Fourier 
Transform,  the  Walsh  Functions,  and  the  Wiener  filtering 
technique.   The  Walsh  Functions  are  particularly  useful 
for  non-linear  signals .   Reference  (53)  provides  more 
details  in  this  area. 

H .    A  Simple  Example  in  Multiplexing 

In  Fig.  4.19  the  author  has  designed  a  simple 
triply  redundant  multiplexing  system  to  illustrate  many  of 

the  topics  already  discussed  in  the  preceding  sections  of 

(50  54) 
chapter  4.    '      The  design  is  intended  to  be  general 

enough  so  that  its  methodologies  can  be  applied  to  most 

engineering  systems. 

The  signal  levels  out  of  many  transducers  are  usually 
in  the  millivolt  range,  possibly  10  or  100  mV  full  scale. 
In  addition,  the  transducers  are  often  located  in  a  noisy 
environment.   In  Fig.  4.19  it  is  assumed  that  the  trans- 
ducer output  is  about  10  mV  and  that  its  two  output  leads 
are  electrically  isolated  from  ground.   The  cable  leading 
from  the  transducer,  however,  is  subject  to  capacitive 
and  inductive  noise  pickup. 

By  using  shielded  cable,  most  noise  pickup  can  be 


-    106    - 


>    5 


^ 


?     .T 


V 


J 


O  u) 

O  O 

_l  — . 

<c  > 

<  « 


w 

^ 

<D 

O 

a 

>i 

-a 

rH 

CO 

0) 

c 

-p 

03 

aj 

fc 

k 

-P 

aj 

Q, 

O 

CD 

-P 

CO 

-P 

T3 

X 

CD 

CD 

h 

c 

0 

5 

T3 

O 

CD 

tt 

£ 

U 

T3 

o 

C 

<H 

cfl 

fc 

<u 

cu 

C 
•H 

CD 

rH 

a 

•H 

r-i 

3 
S 

c 

•H 
CD 


£ 

cti 

W 

CD 
H 

a 

£ 

•H 

in 
< 


a> 


to 

•H 


-  107  - 

minimized;  however,  common-mode  noise  may  still  exceed  the 
transducer  output  by  several  orders  of  magnitude.   Common- 
mode  noise  is  that  component  of  the  total  noise  picked  up 
which  is  common  to  e   and  ep.   It  is  the  major  role  of  the 
instrumentation  amplifier  to  provide  common-mode-noise 
rejection.   Moreover,  the  amplifier  amplifies  the  signal 
e.  -  e_,  and  provides  a  high  input  impedance  and  a  low 
output  impedance. 

The  low-pass  filter  just  upstream  of  the  parallel  A/D 
converter  is  used  simply  to  filter  out  any  high  frequency 
spectral  contents  in  the  original  transducer  signal. 
Sometimes,  no  filtering  is  needed  because  of  the  low-pass 
characteristics  of  the  signal  and  noise  or  the  input  cable. 

The  parallel  16-bit  A/D  converter  used  here  has  already 
been  discussed  at  the  end  of  chapter  1.   The  most  evident 
advantage  of  parallel  conversion  is  its  tremendous  speed. 
The  information  no  longer  has  to  be  converted  bit  by  bit 
because  as  the  input  changes,  the  output  code  also  changes. 
With  a  parallel  A/D  converter,  a  sample  and  hold  circuit 
is  no  longer  needed. 

As  mentioned  in  chapter  1,  A/D  conversion  is  performed 
near  the  signal  source,  and  each  instrumentation  package 
is  powered  from  a  separate  power  source.   After  the  signals 
have  been  converted  from  analog  to  digital,  they  are  then 
transmitted  to  the  control  center  for  multiplexing. 
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Here,  the  three  redundant  signals  are  processed  by  the 
vote-taker;  the  output  will  simply  be  the  median  value  of 
the  three  input  signals.   The  switching  action  of  the  voting 
element  will  inevitably  produce  considerable  spikes  on  its 
output,  so  a  low-pass  filter  is  needed  here. 

Before  the  signal  is  sent  on  its  last  leg  to  the  digital 
meter  for  display,  it  is  processed  through  an  averager 
(already  examined  in  detail  in  section  G)  for  further  noise 
reduction.   The  digital  signal  can  also  be  sent  to  a  D/A 
converter  so  that  the  analog  output  can  be  used  in  an 
analog  control  scheme,  like  the  positioning  of  a  valve  based 
on  flow  signals. 

The  author  hopes  that  with  the  above  example,  the 
reader  has  acquired  a  better  understanding  of  the  various 
functions  of  a  control  system  that  uses  redundant  instru- 
mentation, and  more  importantly,  how  all  of  the  components 
perform  together  to  enhance  the  reliability  of  any  noisy 
signal . 

In  chapter  5  a  case  study  of  some  of  the  control  systems 
at  the  Deer  Island  Sewage  Treatment  Plant  will  be  presented. 
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CHAPTER  V 
DEER  ISLAND  SEWAGE  TREATMENT  PLANT  - 
A  REVISITED  CASE  STUDY 

A.  Introduction 

The  Deer  Island  Sewage  Treatment  Plant  in  Boston, 
Massachusetts  presents  a  very  unique  case  study  in  control 
systems  engineering.   In  order  to  control  pump  speed  at  the 
Deer  Island  plant,  flow  and  level  signals  from  the  three 
headworks  must  be  transmitted  to  the  pumping  station  at 
Deer  Island,   These  telemetered  variables  must  be  extremely 
reliable  to  prevent  any  massive  overflows  or  even  flooding 
at  the  pumping  station.   The  control  system  at  Deer  Island 
employs  an  unique  method  to  assure  transmission  reliability 
by  checking  for  any  differences  between  the  transmitted 
and  returned  signals.   Here,  "returned  signal"  refers  to 
a  signal  that  has  reached  its  destination,  but  has  now 
returned  to  its  source.   The  reader  will  be  introduced  to 
this  clever  control  scheme  in  the  following  pages. 

B.  System  Description 

The  Deer  Island  Sewage  Treatment  Plant  is  the  larger 
of  the  two  sewage  treatment  plants  within  the  Metropolitan 
Sewerage  District  (MSD)  in  the  Boston  Harbor-Eastern 
Massachusetts  Metropolitan  Area.   The  Metropolitan  Sewerage 
District  comprises  of  43  cities  and  towns,  and  225-mile 
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network  of  interceptor  sewers  leading  to  processing  facilities 

at  the  Deer  Island  and  Nut  Island  (the  2 —  plant)  sewage 

(55) 
treatment  plants.      Here,  primary  treatment  is  given  to 

a  combined  average  daily  flow  of  450  million  gallons  and  a 

maximum  daily  flow  of  1.2  billion  gallons  at  these  two 

plants.   Wastewater  from  almost  two  million  people  and 

stormwater  runoff  from  rainfall  are  processed  to  remove 

suspended  solid  matter  and  chlorinated  to  destruct  bacteria, 

prior  to  discharge  into  Outer  Boston  Harbor. 

The  next  paragraph  briefly  describes  the  basic  functions 
of  the  pumping  station  at  Deer  Island. 

A  major  portion  of  the  flow  from  communities  in  the 
Boston  metropolitan  area  located  near  the  Mystic  and  Charles 
rivers  empties  into  deep  rock  tunnels  under  Boston  Harbor 
which  carry  it  to  the  Deer  Island  Treatment  Plant.   The 
pumping  station  at  Deer  Island  is  required  to  lift  flows 
from  the  deep  rock  tunnels,  which  are  some  300  feet  under 
Boston  Harbor,  into  the  treatment  plant.   The  pumping 
station  has  a  capacity  of  810  million  gallons  per  day. 

Professor  Henry  M.  Paynter  of  M.I.T.  has  long  been 
closely  associated  with  the  pumping  station  and  its  control 
systems  at  the  Deer  Island  plant.   In  January  1982,  the 
author  visited  the  Deer  Island  plant  and  the  Chelsea  Creek 
Headworks  for  the  first  time.   The  visit  was  made  possible 
only  with  the  most  congenial  cooperation  from  Messrs. 
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Ken  Donavon  and  Paul  Sullivan  of  the  Deer  Island  plant  and 
with  Professor  Paynter  as  a  most  knowledgeable  guide.   Fig. 

5.1  shows  a  diagram  of  the  entire  Deer  Island  plant  and 

(55) 
basically  how  it  works. 

One  must  be  selective  in  making  a  case  study  of  a 

complex  system  like  the  Deer  Island  plant;  therefore,  the 

author  intends  to  cover  only  some  of  the  control  systems 

which  are  relevant  to  this  thesis.   In  particular,  the 

areas  that  will  be  covered  are  the  followings: 

1.  Sewage  Tunnel  System 

2.  Central  Control  Panel 

3.  Digital  telemetry  vs.  aging  analog  system 

4.  Instrumentation  for  electric-driven  pumps 

5.  Instrumentation  for  future  electrical  generators 

C,   Sewage  Tunnel  System 

The  Metropolitan  Sewerage  District  tunnel  system 
is  shown  in  a  simplified  schematic  form  in  Fig.  5.2a. 
Here  the  dash  components  denote  the  flow  and  level-control 
action.   The  block  diagram  in  Fig.  5.2b  can  be  used  to 
investigate  hydraulic  transients  in  such  sewage-disposal 
system,  as  Paynter  was  called  upon  to  perform  at  one  time. 
The  physical  elements  are  interconnected  as  shown  in  Fig. 
5.2C.(56'57) 

If  a  control  scheme  is  designed  so  that  the  downstream 
flow  Qc  simply  follows  the  inflow  Qa,  rather  violent  surges 
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Fig.  5.2c 

will  occur  whenever  the  flow  is  disturbed.   Such  heavy 
transients  cannot  be  tolerated;  thus  the  pumps  at  the  Deer 
Island  plant  are  placed  under  control  of  the  following 
telemetered  variables: 

(a)  Input  flow   Qa 

(b)  Upstream  level  H- 

(c)  Downstream  level  H? 

(d)  Output  flow   Qc 

Using  the  above  variables,  the  pumps  are  constrained 
by  the  following  relations: 

Qc  =  Oa  +  Q. 

d  Q,                       d  H 
T  —  +   Qt  =  B1  H1  +  B2  T  — 


dt  dt 

where  B- ,  B^,  and  T  are  controller  adjustments 
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An  ASME  publication  entitled  "The  Dynamics  and  Control 

( 58 ) 
of  Eulerian  Turbomachines"     by  Paynter  provides  an  in- 
depth  study  of  the  actual  control  scheme  for  individual 
pumping  units  (inner  loop  of  Fig.  5.2c). 

As  one  can  see,  the  reliability  of  the  four  telemetered 
variables  is  vital  to  the  operations  of  the  pumping  station. 
In  the  next  section,  the  reader  will  be  introduced  to  a 
sophisticated  control  panel  (even  in  today's  perspective) 
that  monitors  the  reliability  of  the  flow  and  level  signals. 

D.   Central  Control  Panel 

As  mentioned  in  section  C,  flow  and  level  signals 
are  continuously  used  as  part  of  a  control  scheme  to 
regulate  the  speed  of  the  pumps.   A  highly  visible  control 
panel  that  shows  the  quality  of  each  flow  and  level  signal 
is  located  in  the  main  pumping  station  control  room.   From 
Fig.  5.1,  it  is  clear  that  the  Deer  Island  plant  receives 
pretreated  sewage  from  the  three  headworks,  namely  Ward 
Street,  Columbus  Park,  and  Chelsea  Creek.   Accordingly, 
flow  and  level  readings  from  the  three  headworks  must  be 
closely  monitored. 

Since  the  six  telemetered  control  variables  must  be 
transmitted  from  the  headworks  to  the  Deer  Island  plant, 
transmission  reliability  cannot  be  overemphasized.   The 
Deer  Island  plant  uses  an  elaborate  control  scheme  to 
monitor  the  reliability  of  the  transmitted  signals.   Fig.  5.3 


-  116  - 

(59) 
shows  the  operations  of  such  monitoring  system. 

At  one  of  the  headworks  analog  signal  from  the  flow 
instrument  (Parshall  flume)  or  level  indicator  (bubbler 
tube)  is  first  converted  into  an  air  signal,  ranging  from 
3  to  15  lb.  pressure.   The  air  signal  is  in  turn  used  to 
modulate  a  carrier  frequency;  this  process  is  performed 
in  the  block  labeled  modulator.   The  modulated  wave  is 
then  sent  to  the  multiplexer  for  multiplexing  before 
transmitted  to  the  Deer  Island  plant.   Here,  the  term 
"multiplexing"  refers  to  the  simultaneous  transmission  of 
several  messages  at  different  frequency  bands  over  a 
common  line.   The  signals  from  the  headworks  to  the  Deer 
Island  plant  are  transmitted  simultaneously  on  microwave 
and  leased  line. 

At  the  receiving  end  at  Deer  Island,  the  received 
signal  is  first  recovered  by  using  band-pass  filters  in 
the  de-multiplexer;  the  signal  is  then  demodulated  to 
retrieve  the  original  signal.   This  analog  signal  is  in 
turn  converted  to  an  air  signal  to  be  used  as  part  of  the 
pneumatic  pump  speed  control  system. 

The  air  signal  mentioned  above,  in  addition  to  being 
used  to  regulate  pump  speeds,  is  sent  back  to  another 
set  of  modulator  and  multiplexer  so  .that  the  signal  can 
now  be  transmitted  back  to  the  headworks  for  comparison. 

At  the  headworks,  the  returned  analog  signal  is 
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converted  back  to  an  air  signal.  Here,  the  air  signal  that 
has  just  returned  is  compared  with  the  original  air  signal 
for  any  differences.  The  differences,  if  any,  are  indicated 
by  a  set  of  GREEN,  AMBER,  and  RED  lights.  The  differences 
in  air  signals  are  next  transmitted  back  to  Deer  Island  so 
that  the  control  panels  at  both  the  headworks  and  the  Deer 
Island  plant  have  the  same  indications  on  their  status  boards, 

Fig.  5.4  shows  the  status  board  at  the  Deer  Island  plant. 
The  three  lights  are  defined  as  follow     (where  tolerances 
are  representative  values  only): 

GREEN <  -    1% 

AMBER <  i    5°/o 

RED        >  i    5% 

If  a  red  light  stays  on  for  more  than  one  second,  the 
system  is  designed  to  automatically  switch  to  the  alternate 
mode,  either  from  microwave  to  leased  line,  or  vice  versa. 

A  control  panel  such  as  the  one  used  at  the  Deer 
Island  plant  greatly  improves  the  confidence  level  of  the 
operator.   For  example,  if  all  lights  are  green,  the  operator 
knows  that  transmission  quality  is  almost  f lav/less.   Even 
when  one  light  is  amber,  as  was  the  case  during  the  author's 
visit,  there  is  no  need  for  urgency  or  immediate  action;  it 
may  be  the  result  of  a  minor  problem,  such  as  a  faulty  module 
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E.  A  Need  for  Newer  Design 

As  in  any  aging  system,  replacement  parts  often 
present  the  most  insurmountable  problem.   Analog  transmission 
equipment  can  still  be  replaced,  although  their  digital 
counterparts  usually  have  much  higher  availability  and  at 
considerably  lower  cost.   Pneumatic  control  devices,  on  the 
other  hand,  are  almost  vanished  from  the  open  market. 
Replacement  parts  are  extremely  difficult  to  be  found.   It 
would  be  economically  infeasible  to  have  each  replacement 
made  to  its  own  specifications  by  a  manufacturer. 

A  digital  system  has  many  desirable  features  that  make 
it  a  natural  choice  eventually  to  replace  the  analog  system. 
The  technique  of  pulse-code  modulation  is  particularly 
attractive,  as  the  reader  will  see  why  in  the  next  section. 

F.  Digital  Telemetry 

1.    Pulse-Code  Modulation 

In  digital  communications,  a  multiplexed 
system  often  used  is  the  technique  of  time  division- 
multiplex  (TDM)  in  which  the  signal  messages  are 
organized  in  subsequent  time  intervals,  usually  by 
sending  one  sample  of  each  message  after  the  other  in 
a  cycle  or  frame  and  sending  one  frame  after  the  other. 
If  each  sample  in  the  TDM  system.,  is  represented  in 
digital  form,  a  pulse-code  modulation  (PCM)  multiplex 
is  obtained. 
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The  author  feels  that  a  digital  telemetry  system 
using  pulse-code  modulation  deserves  careful  consider- 
ation as  a  replacement  for  the  aging  analog  system. 
Some  of  the  characteristics  that  are  inherent  in  a 
digital  communication  system  make  the  PCM  system 
considerably  more  desirable  as  compared  to  its  analog 
counterpart.   In  addition,  a  decreasing  cost  of 
implementation  due  to  the  technological  evolution  in 
solid  state  digital  integrated  circuits  makes  such 
communication  system  all  the  more  attractive. 

One  of  the  important  advantages  of  a  digital  system 
is  its  relative  immunity  to  noise  pickup.   Any.  noise 
picked  up  in  transmission  will  ride  on  top  of  the  pulse 
and  /  or  produce  grass  between  the  pulses.   However, 
as  long  as  a  pulse  can  be  distinguished  from  the  noise, 
there  is  no  problem. 

Pulse-code  modulation  uses  a  binary  digital  code. 
The  peak-to-peak  value  of  the  signal  to  be  transmitted 
is  divided  into  a  number  of  discrete  steps.   The  number 
of  bits  used  in  the  binary  code  determines  the  total 
number  of  steps  available  and  the  accuracy  of  the 
transmitted  values.   For  example,  a  16-bit  digital  word 
provides  2   or  65,536  steps.   Clearly,  the  smaller  the 
value  each  step  corresponds  to,  the  higher  the  accuracy. 
Reference  (61)  provides  a  more  in-depth  explanation  on 
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PCM. 

Obviously,  a  16-bit  word  provides  considerably 
more  accuracy  than,  for  example,  a  3-bit  word.   However, 
the  transmission  of  16-bit  signals  require  a  much 
greater  bandwidth.   In  order  to  minimize  bandwidth  while 
maintaining  accuracy,  several  techniques  have  been 
employed.   One  method  involves  the  use  of  adaptive  data 
compression,  also  referred  to  as  "redundancy  reduction". 
In  this  technique,  any  sampled  data  which  would  not  add 
significant  value  to  the  received  information  is 
considered  redundant  and  need  not  be  transmitted.   As 
a  result,  the  sampling  rate  is  sharply  reduced  and  so 
is  the  bandwidth.   More  on  this  subject  in  the  actual 
implementation  of  such  system. 
2.    Implementation 

Fig.  5.5  shows  a  block  diagram  of  a  digital 
telemetry  system  using  digital  filtering,  data  compression, 
and  error  control  coding.   The  author  considers  such 

system  a  viable  choice  to  replace  the  aging  analog 

(51) 
system.      As  before,  flow  and  level  signals  will  be 

transmitted  from  the  three  headworks  to  the  Deer  Island 

plant,  except  now  that  transmission  is  via  digital 

telemetry  with  pulse-code  modulation. 

Even  with  the  new  digital  system,  there  is  no 

reason  to  replace  the  color  coded  status  light  panel. 
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Actually,  the  status  lights  are  so  useful,  yet  so  simple, 
that  the  people  at  Deer  Island  have  become  quite  fond  of 
them.   Thus,  the  status  board  will  be  incorporated  into 
the  new  digital  system,  still  indicating  the  differences, 
if  any,  between  the  original  signal  (no  longer  an  air 
signal)  and  the  returned  signal.   In  fact,  it  is  practical 
to  simply  connect  the  digital  system  in  parallel  with 
the  analog  system;  then,  with  the  flip  of  a  switch,  the 
operator  can  have  the  control  system  operate  on  either 
mode. 

In  Fig.  5.5  the  three  blocks:   digital  filter, 
data  compression,  and  spectral  estimation  all  perform  as 
a  team  to  regulate  the  bandwidth  of  the  signals  being 
transmitted.   The  digital  filter  (usually  a  low-pass 
filter)  prefilters  the  telemetry  signals  in  such  a  way 
that  the  following  data  compressor  can  operate  in  the 
most  efficient  way.   As  mentioned  earlier,  data  comp- 
ression reduces  the  amount  of  data  to  be  transmitted  by 
removing  all  redundant  information.   If  the  remaining 
important  data  are  reorganized  at  constant  time 
intervals,  the  number  of  sampled  points  are  greatly 
reduced.   By  this  technique,  it  has  been  found  possible 
to  reduce  the  number  of  sampled  points  by  at  least  a 
5  to  1  ratio,  and  in  some  cases  by  as  much  as  160  to 
1.   By  reducing  the  number  of  samples  taken,  the  pulses 
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per  second  of  modulation  are  reduced,  and  the  bandwidth 
required  is  decreased. 

Spectral  estimation  is  a  rather  useful  method  to 
perform  short-time  spectral  estimation,  and  thereby 

adapt  the  sampling  frequency  to  a  more  appropriate 

(51) 
value.      In  general,  the  sampling  frequency  is  kept 

at  the  minimum  possible  value  consistent  with  the 

signal  frequency  content  in  order  to  reduce  the  amount 

of  data  sampled. 

When  pulse  modulation  is  used,  energy  is  transmitted 
only  during  the  pulse  sampling  intervals.   With  data 
compression  and  spectral  estimation,  the  sampling  rate 
is  sharply  reduced;  therefore,  the  transmitter  duty 
cycle  is  quite  low,  and  the  overall  transmission 
efficiency  is  greatly  improved. 

Error  control  coding,  a  technique  that  uses  the 
coder  and  decoder,  performs  a  protective  measure  on 
the  transmitted  signals.   Before  the  data  entering 
the  communication  channel,  suitable  control  data 
(a  given  number  of  bits  in  an  information  word)  are 
added  by  the  coder-  At  the  receiving  terminal,  the 
same  control  data  are  utilized  by  the  decoder  to 
detect  (error  detection)  or  correct  (error  correction) 

the  errors  introduced  by  the  communication  channel  or 

(51) 

other  disturbances  and  interferences. 
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The  reader  may  have  noticed  that  the  technique 
of  error  control  coding  performs  a  function  that  is 
similar  to  that  of  the  status  lights,  to  assess  the 
quality  of  the  transmitted  signals.   Therefore,  if 
the  status  lights  remain  as  an  integral  part  of  the 
new  system,  coding  the  transmitted  signals  may  not 
be  needed.   Of  course,  one  can  always  use  it  as  an 
extra  redundancy. 

G.    Insufficient  Instrumentation  for  the  Electric-Driven 

Pump 

Currently,  there  are  nine  pumps  at  the  Deer  Island 
pumping  station.   Eight  pumps  are  run  by  diesel  engines, 
while  the  ninth  pump  is  a  variable  speed  electric-driven 
pump  powered  by  on-site  generators.   With  the  U.S.  diesel 
engine  technology  in  its  present  state,  it  is  difficult 
to  expect  the  industry  to  come  up  with  new  design  to  replace 
the  aging  machines.   A  few  years  ago,  an  electric-driven 
pump  was  installed  so  that  its  performance  can  be  evaluated 
for  possible  future  conversion  to  all  electric  pumps. 

If  the  instrumentation  panel  for  the  electric  pump  is 
intended  to  be  a  prototype  for  future  models,  it  is  a  very 
disappointing  one.   There  are  only  two  or  three  instruments 
on  the  electric  pump  control  panel  as  compared  to  almost 
ten  instruments  on  the  diesel  instrumentation  panel.   The 
information  that  one  can  obtain  from  the  electric  pump  panel 
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on  the  overall  plant  operations  is  totally  insufficient.   On 
the  other  hand,  the  diesel  instrument  panel  shows  a  substantial 
amount  of  plant  data.   Shaft  levels  and  flow  rates  from  all 
three  headworks  can  be  seen  clearly  in  a  quick  glance.   In 
addition,  whether  a  particular  unit  is  pumping  from  Chelsea 
Creek  or  Ward  St.  -  Columbus  Park  is  shown  in  plain  view  on 
the  panel.   If  an  operator,  while  facing  this  panel,  has  to 
make  a  sudden  decision  during  a  plant  upset,  he  has  all  of 
the  necessary  plant  data  to  act  upon. 

From  the  above  discussion,  it  becomes  clear  that  adequate 
instrumentation  similar  to  that  on  the  diesel  control  panel 
must  be  installed  on  the  electric  pump  instrumentation  panel. 

H.    Instrumentation  for  Future  Electrical  Generators  • 

At  the  present,  the  five  on-site  generators  provide 
just  enough  electrical  power  for  the  single  electric  pump 
and  the  auxiliaries  (sewage  treatment,  lights,  auxiliary 
pumps,  etc.).   If  more  electric-driven  pumps  are  used  to 
replace  the  aging  diesel  engines,  considerable  more  elect- 
rical power  must  be  needed.   This  in  turn  will  require 
more  electrical  generators  to  be  installed.   One  proposal 
involves  the  installation  of  several  gas  turbine  generators 
using  methane  gas  as  fuel  (methane  gas  is  a  byproduct  from 
the  decomposition  of  sewage  sludge). 

Whether  one  uses  gas  turbines  or  diesel  engines  for 
electrical  generation,  proper  control  systems  and  adequate 
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instrumentation  must  still  be  provided.   The  triply  redun- 
dant multiplexing  system  shown  in  Fig.  4.19  is  a  good 
starting  point  for  the  design  of  such  control  system  using 
redundant  instrumentation.   As  in  any  thermal  power  plant, 
the  parameters  monitored  will  be  temperature,  pressure,  flow, 
and  possibly  density. 

In  chapter  6,  some  particular  aspects  of  instrumentation 
errors  will  be  examined.   Chapter  6  is  different  from 
chapter  2  in  that  chapter  2  dealt  v/ith  instrumentation  errors 
and  uncertainties  in  a  survey  format,  whereas  chapter  6  will 
discuss  some  of  the  methods  that  one  can  use  to  compensate 
for  these  errors. 
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CHAPTER  VI 

PHYSICAL  CONSTRAINTS  IMPOSED  BY  CONSTITUTIVE 
AND  CONSERVATION  RELATIONSHIPS: 
IMPLICATION  FOR  INSTRUMENTATION  REDUNDANCY 

A.  Introduction 

Sometimes  instrumentation  readings  that  obviously 
need  to  be  density  or  temperature  corrected  are  still  being 
used  without  either  correction.   And  occasionally,  instru- 
ment data  that  clearly  violate  laws  of  conservation  are 
still  being  recorded  and  interpreted  as  if  they  were  correct. 
The  area  of  physical  constraints  imposed  by  constitutive 
and  conservation  relationships  is  another  promising  area 
for  redundant  instrumentation.   However,  due  to  lack  of 
time  and  general  unavailability  of  sufficient  literature 
in  this  area,  the  author  will  only  attempt  to  present  a 
cursory  treatment  of  this  subject  matter.  A  few  brief 
examples  will  be  given  later  in  this  chapter. 

B.  Density  Correction 

1.    Computation  of  Density  from  Pressure  and  Temperature 

An  excellent  example  to  illustrate  the  fact 
that  some  instruments  need  density  correction  is  the 
differential  pressure  (d/p)  cell.   The  d/p  cell  is  used 
to  measure  flow  rate  in  either  a  liquid  or  gas  medium. 
The  differential  pressure  caused  by  the  velocity  increase 
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is  proportional  to  the  square  of  the  flow  rate.   More 
specifically,  the  Bernoulli  equation  leads  to  the 


following  flow  rate  relationship: 


V  (flow  rate)  =  Q  =  AV  =  A<J> 


.(62) 


2A  P 
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Fig.  6.1   Differential  Pressure  Cell 


From  equation  6.1,  the  following  mass  flow  rate  (M) 
expression  can  also  be  established: 


Q     /N/ 


A  P 
P 


M  =   p  Q    ~    [~p 

'mean  ^y  ~ 


mean 


A  P 


(6.2) 


(6.3) 


Clearly,  P-  and  P2  can  be  measured  experimentally, 
as  indicated  by  the  pressure  taps  in  Fig.  6.1.   If 
fluid  properties  are  also  known,  one  would  only  need 
temperature  to  compute  density.   With  A  P,  p    ,  and 
A  (physical  dimensions  of  orifice  plate),  the  actual 
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mass  flow  rate  can  be  easily  calculated.   Since  T?  is 
usually  not  equal  to  T. ,  thus  temperature  measurement 
here  refers  to  an  average  value  of  T1  and  T?.   More 
on  temperature  correction  in  section  C. 
2.   Actual  Measurement  of  Density 

Since  1     is  normally  not  equal  to  T~9   P-  will 
be  different  from  p      .   Therefore,  both  /O   and  p  ? 
must  be  measured  to  obtain  a  more  correct  value  for 
density.   Again,  here  a  more  correct  value  could  simply 
be  the  mean  value  of  p  1  and  p  p.   As  for  density 
measuring  device,  one  can  use  the  vibration  type  liquid 
densitometer  described  in  chapter  2  to  measure  the  two 
density  values. 

C.    Temperature  Correction 

As  mentioned  in  the  last  section,  T-  and  T~  of 
Fig.  6.1  do  not  normally  share  the  same  value.   The  following 
paragraphs  will  briefly  explain  this  phenomenon. 

As  the  fluid  passes  through  the  orifice  plate,  some  of 
the  kinetic  energy  (no  matter  how  infinitesimal)  will  be 
lost  due  to  impingement  of  the  liquid  on  the  plate.   This 
loss  in  kinetic  energy  is  usually  recovered  in  the  form  of 
heat,  or  a  slight  increase  in  temperature  on  the  orifice 
plate  and  in  the  fluid.   Therefore  T2  will  no  longer  be 
the  same  as  T.. 

Since  some  of  the  total  energy  is  lost  at  the  orifice 
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plate,  the  total  energy  at  point  1  (H  )  must  be  greater  than 
the  total  energy  at  point  2  (Hp),  or  A  H  =  H.  -  H„  >  0, 
Since  one  can  assume  with  reasonable  accuracy  that  |ah| 
is  proportional  to  the  change  in  internal  energy,   IauI  , 


it  can  be  concluded  that  Tp  -  T1  >  0.   In  sum,  the  situation 


in  Fig,  6.1  can  be  expressed  as  follows 


If  AH  =  H1  -  H2  >  0 


.(63) 


and  AH 


|au| 


then  T  -  T-  >  0  . 

As  one  can  see,  in  order  to  get  a  more  representative 
value  for  temperature, .  both  T1  and  Tp  must  be  measured. 

D.    How  to  Minimize  Data  Error  in  a  2-Phase  Region 


P  ,  PT  ,  T   and  TT  are  raeasureid  values 
v*   L'   v       L 


Vapor 


Liquid 


& 

Pv 
i 

II 

Q> 

Pl 

'1 

Interface 
Region 


Fig.  6.2   2-Phase  Region 
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In  a  2-phase  region  like  that  shown  in  Fig.  6.2, 
it  is  often  difficult  to  determine  true  temperature  and 
pressure.   The  two  procedures  described  in  the  following 

paragraphs  should  prove  to  be  quite  valuable  in  minimizing 

(  63  ) 
data  error.    '   The  reader  should  be  aware  of  the  fact 

that  the  two  correlation  procedures  will  not  produce 

identical  results.   One  method  will  normally  produce  a  more 

accurate  result  than  the  other,  as  the  author  will  illustrate 

with  a  simple  example. 

Procedure  1 

a.  Determine  T   .  (P  )  and  T   .  (PT ) 

sat   v       sat   L 

b.  With  the  four  data  points:   T  (P  ) ,  T  (PT),  T 

S   V      S    Li      V 

and  T  ,  minimize  error  by  the  following  methodology: 
i-i 

4  2 

let  E(error)  =  £  (Wk  Tk  -  T)^ 

where  W,  are  weight  factors  based  on  confidence 


level  of  each  measurement 


then     E   =    £    (W~k2   TR2  -   2   \J     TR   T   +  T2) 
k=1 

=  Z  K2  Tw2  -  2  T  £  Wv  Tk  +  4  t2 


k   k    fc  *  *•*    k  k 

k   k 


Minimizing  E  yields:       =  0  =  -2  H  W  T   +  8  T 


dT 


T  = 


c.   Since  this  is  a  saturated  state,  if  T   .  is  knovm, 


P    can  be  determined. 
sat 
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Procedure  2 

a.  Determine  P   .  (T  )  and  P   .  (TT ) 

sat    v       sat    L 

b.  V/ith  P   (T  ),  P   (TT),  P   and  PT  ,  repeat  part  b 
of  procedure  1  to  find  P   .  . 

c.  If  P   .  is  known,  T   .  can  be  easily  found. 


E.   An  Example  in  Minimization  of  Data  Error 

For  this  example,  the  2-phase  medium  is  assumed  to 
be  saturated  vapor  and  liquid  at  400.0  F  and  247.26  psi. 
In  the  vapor  region,  due  to  the  insulation  effect  of  a  steam 
blanket,  pressure  can  normally  be  measured  with  greater 
accuracy  than  temperature;  therefore,  the  following  contamin- 
ated values  of  pressure  and  temperature  and  their  weight 
factors  (W's)  are  assumed: 

P   =  248.00  psi  T   =  396.50°F 

v  *  v 

PL  =  246.20  psi  TL  =  401.50°F 

W  (Pv)  =  0.5  W  (Tv)  =  0.1 

W  (P  )  =  0.2  W  (TL)  =  0.2 

In  order  to  determine  temperature  values  given  pressure 
measurements,  or  vice  versa  (as  required  by  procedures  1  &  2), 
the  method  of  interpolation  is  often  used  if  one  needs  to 
determine  values  that  lie  between  tabulated  data  in  a  steam 
table.   However,  the  results  obtained  from  such  method  are 
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rarely  reproducible.   With  the  advent  of  digital  computer, 
the  technique  of  analytical  curve  fitting  becomes  practical. 
Moreover,  the  results  are  always  reproducible. 

One  can  use  the  following  procedure  to  fit  the  saturation 
curve  analytically.   In  this  procedure  an  algebraic  expression 
is  determined  by  performing  linear  regression  on  several  data 
points  from  the  saturation  curve.   Once  determined,  this 
algebraic  relationship  can  be  used  to  generate  pressure  values 
based  on  temperature  inputs,  or  vice  versa. 

If  a  transformation  is  performed  on  the  two  parameters, 
pressure  (P)  and  temperature  (T),  two  new  variables  can  now 
be  defined  as  follow: 

X  =  where  T  is  absolute  (6.4) 

T 

Y  =  In  P  (6.5) 
With  the  two  new  variables,  one  can  easily  use  the 

following  linear  laws  for  curve  fitting  the  saturation  line: 
X  =  a  -  b  Y  (6.6) 

Y  =  c  -  d  X  (6.7) 
where  a,  b,  c  and  d  are  constants  that  will  be 
determined. 

The  reader  should  be  aware  of  the  fact  that  if  only 
two  data  points  are  used  to  fit  the  saturation  curve, 
identical  curves  will  result  by  either  correlation  method 
(Y  vs.  X  or  X  vs.  Y). 
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Using  five  data  points  from  the  saturation  curve  and  the 
technique  of  linear  regression  on  each  of  the  two  equations 
(6.6  &  6.7),  the  following  values  for  constants  a,  b,  c  and 
d  were  determined: 

a  =  3.27  x  10~3 
b  =  2.14  x  10""4 
c  =  15.30 
d  =  4,676.17 
Thus  equation  6.6  and  6.7  can  now  be  rewritten  as  follow: 

-^-  =  3.27  x  10"3  -  (2.14  x  10"4)  In  P         (6.8) 
T 

in  P  =  15.30  -   4i676-17  (6.9) 

T 

With  equations  6.8  and  6.9,  one  can  proceed  to  procedures 
1  and  2  in  this  example. 
Procedure  1 

a.   Using  equation  6.8,  the  following  temperature  values 

are  found: 

T   .  (P  )  =  T   (248.00  psi)  =  400.27°F 
sa  u   v     s 

T   .  (P.)  =  T   (246.20  psi)  =  399.63°F 
sat   L     s 

b-   Tsat  =  £Wk4k         where  Tk  -  Ts  (V<  Ts  (PL>' 

T  and  TT 
v      L 

Using  the  weight  factors  assumed  earlier, 

T   .  becomes  400.01°F. 
sat 
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c.   With  T   .  =  400.01°F,  using  equation  6.9, 
Psat  =  247-27  Psi- 


Procedure  2 


a.   Using  equation  6.9,  the  following  pressure  values  are 
determined: 

Psat  (Tv^  =  Ps  (396«50°F)  =  237.55  psi 

Psat  ^TL^  =  P   (401«50°F)  =  251.50  psi 


Z\   Pk 


b.  Psat  = - — —  Where  P.  =  P   (T  )  ,  P   (TT  ) 

4  k    s   v  '   s   L 

P   and  PT 
v      L 

Using  the  weight  factors  assumed  earlier,  P   . 

becomes  247.29  psi. 

c.  With  P   .  =  247.29  psi,  using  equation  6.8, 

Tsat  "  400-°2°F 
As  the  reader  might  have  observed,  the  temperature  and 
pressure  values  deduced  from  both  correlation  procedures  are 
almost  identical  to  the  true  values.   However,  one  should 
be  aware  that  such  closeness  between  these  two  sets  of  values 
has  been  partially  due  to  a  coincidence  in  correlation  between 
the  contaminated  values  and  their  respective  weight  factors. 

F.    Redundant  Parameters  -  T,  P,  p 

In  this  section,  the  technique  of  using  redundant 

(•  go  \ 

parameters  to  minimize  data  error  v/ill  be  discussed. 
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As  the  reader  knows,  any  one  of  the  three  parameters,  T,  P, 
and  /O  can  be  considered  as  redundant,  and  any  two  of  the 
three  parameters  can  be  used  to  compute  the  value  of  the 
third  redundant  parameter.   Furthermore,  the  computed  value 
can  then  be  used  to  check  on  the  accuracy  of  the  actual 
measurement.   This  procedure  is  illustrated  as  follows: 

3^5%  (vapor)   "j 

3  i  2%    (liquid)  J  \^> »►  p 


3  i  2%  P  '    > *-   P 


c 


/O    -* *-        T 

'  c 


Range  of  measured  computed 

Measurements  values  values 

(The  range  of  measurements  is  based  on  readings  from 
three  redundant  instruments). 

A  general  procedure  to  minimize  measurement  errors  is 
described  as  follows: 

1.  Measure  T  ,  P  ,  and  Q       experimentally 

mm      '  m 

2.  Compute  T  ,  P  ,  and  p       and  use  these  as  the  adopted 
values  for  TadQpted,  Padopted,  and  p  adopted 

3.  Formulate  the  following  least  squares  error  expression 
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Let  E  (error)  ■  W   (P   -  P  )2  +  V/m  (T   -  T  )2 
'  p  v  m     a      T    m    a 


+  Wo  ( p       -  p       ( T  ,  P  )  )  2 
"  '  m       '   a   a*   a 

where  W  ,  W T,  and  \Jp   are  weight  factors  based 

on  standard  deviations  of  instrument  readings. 

4.  Minimize  error  by  the  following  equations: 

Hov/ever,  the  expressions  found  for  P  ,  T  ,  and  p 

a   a       *a 

must  be  subject  to  the  constraint  of  the  state 
equation,  <p  (Pa>  T&,  /O  &)  =  o 

5,  Must  distribute  corrections  so  as  to  reduce  errors 
based  on  constraint. 

G.    The  Role  of  Conservation  Laws  in  Measurements 

All  engineers  know  that  the  laws  of  conservation, 
such  as  mass  conservation,  momentum  conservation,  and  energy- 
conservation  can  never  be  violated.   However,  instrument 
readings  that  clearly  violate  these  lav/s  are  often  still 
being  recorded. 

The  following  three  brief  examples  exemplify  some  typical 
situations  in  which  the  instrument  readings  might  be  left 
in  error  if  the  specific  relationships  are  violated: 

1.   Conservation  of  Mass 

M  =  S  Flowin  "  H  Flowout  (6.10) 
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Fig.  6.3   Flow  Measurement 


In  Figure  6.3  the  sum  of  F   and  F,  at  any  time  t 
to  a      b      J 

is  not  necessary  equal  to  F   .  .   Hov/ever,  if  one  takes 
the  time-averaged  measurements  of  the  three  flows, 
within  the  accuracy  of  the  instruments,  the  following 
relationship  should  always  hold: 


Ef. 


+  EF. 


EF 


(6.11) 


a     "  b       *-*  out 
If  the  above  relationship  is  violated,  then  the 
errors  must  be  distributed  accordingly  among  the  three 
flowmeters.   Reference  (64)  provides  an  in-depth  study 
of  many  of  the  commonly  found  flowmeters. 
2.   Conservation  of  Momentum 

G   =     V   Force.   -  TT Force   .  (6.12) 

**      in   *-*     out 

For  any  flow  in  the  direction  indicated  as  shov/n 
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M/ 


Fig.  6.4  Pressure  Measurement 

in  Fig.  6.4,  P   must  be  greater  than  P   .   If  the 
pressure  sensors  indicate  differently,  one  or  both 
instruments  must  be  in  error  and  need  to  be  adjusted, 
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Fig.  6.5   A  Simple  Heat-Exchanger 
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3,   Laws  of  Thermodynamics 

Example  3  as  illustrated  in  Fig.  6.5  is  a  much  more 
complex  case.   Careful  energy  and  heat  balance  calculat- 
ions must  be  performed  before  any  violation  of  thermo- 
dynamic laws  can  be  shown. *  ' 

By  the  first  law  of  thermodynamics,  the  following 

expression  is  true: 

m.     (h  ,     -h    .)  m   m   .    (hTTTT  -  h„T.)   (6.13) 
steam   steam    cond     water   HW    CVr 

Clearly,  specific  data  such  as  mass  flow  rates 
(m's)  and  enthalpies  (h's)  are  needed  for  the  energy 
balance  calculations  before  any  given  instrument  can  be 
isolated  as  faulty. 

In  addition,  if  one  considers  the  second  law  of 
thermodynamics,  then  the  following  relationship  in 
terms  of  entropy  (s)  is  always  true: 


m  . 
steam 


m   . 
water 


cond 


water 


SHW  > 


m  , 
steam 


steam 


scw  (6.15) 


One  must  realize  that  although  the  heat  exchange 
between  the  system  and  surroundings  can  be  assumed  to 
be  zero,  an  increase  in  entropy  is  to  be  expected, 
because  the  process  is  basically  irreversible. 

It  should  be  clear  to  the  reader  that  concern  for 
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the  physical  constraints  imposed  by  laws  of  nature  is 
indeed  an  important  aspect  of  redundant  instrumentation, 
Only  occasionally  are  attempts  made  by  engineers  to 
distribute  instrument  errors  consistently  within  a  real- 
time system*   Much  more  work  remains  to  be  explored 
in  this  area. 
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APPENDIX  I 
VARIOUS  TEMPERATURE  AND  PRESSURE  SENSORS 

A.  Platinum  RTDs 

Platinum,  being  a  noble  metal,  is  used  almost 
exclusively  for  precision  resistance  thermometers.   Platinum 
resists  corrosion  and  chemical  attack  under  most  environments, 
so  it  is  fairly  stable.   In  addition,  it  is  easily  workable 
and  can  be  drawn  into  fine  wires.   Moreover,  platinum  has 
a  high  melting  point  (1772  C)  and  in  fact,  shows  little 
volatilization  below  1000  C.   All  this  is  evidenced  by  a 
linear  and  stable  resistance-temperature  (R  -  T)   relation- 
ship that  characterizes  the  platinum  sensor  over  a  wide 
range  of  temperatures.   An  early  example  of  a  platinum 
RTD  from  the  National  Bureau  of  Standards  is  shown  in  Fig.  1. 

B.  Carbon  Resistance  Thermometry 

1 .    Advantages  and  Disadvantages 

The  carbon  resistance  thermometer  has  a  number 
of  desirable  qualities  as  a  secondary  thermometer, 
including  high  thermometric  sensitivity,  small  physical 
size,  fast  response,  ease  of  installation,  and  very 
low  cost.   The  major  drawback,  however,  is  that  there 
is  no  well-defined  theoretical  (or  empirical)  resistance- 
temperature  relation  for  use  in  extrapolation  or 
interpolation.   As  a  result,  a  somewhat  laborious 
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calibration  procedure  is  usually  required  throughout 
the  temperature  range  of  interest. 
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Fig.  1   Construction  detail  of  a  platinum 
resistance  thermometer  tip 


2.    Effects  of  Magnetic  Field 

Experimental  data  showed  that  the  magnetic 
field  effect  is  strongly  dependent  on  temperature  and 
becomes  substantially  larger  as  the  temperature  is 
reduced.   It  is  interesting  to  note  that  the  effect  is 
independent  of  whether  the  magnetic  field  is  applied 
parallel  or  perpendicular  to  the  resistor  axis. 

In  a  time  varying  magnetic  field,  the  effect  may 
be  considerably  more  severe.   Eddy  currents  may  be 
introduced  in  the  leads  which,  by  Joule  heating,  warm 
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the  thermometer  above  the  temperature  of  the  surround- 
ings.  This  is  especially  true  if  the  leads  have  a 
solder  coating.   The  solder  alloy  may  become  super- 
conducting, but  with  a  transition  spread  over  a  wide 
temperature  range.   Therefore,  the  resistance  of  the 
solder  coating  can  be  quite  small  over  a  considerable 
range  of  the  magnetic  field  and  may  result  in  a  large 
dissipation  of  power. 

C.    Germanium  Resistance  Thermometry 

Besides  carbon  thermometry,  a  second  major  category 
of  semiconductor  resistance  thermometry  is  the  germanium 
resistance  thermometer.   The  germanium  thermometers  share 
some  of  the  inherent  problems  with  the  carbon  thermometers, 
such  as  self-heating  errors,  but  it  does  have  its  own 
unique  characteristics. 

Germanium,  in  its  intrinsic  form,  is  a  rather  poor 
resistance  measuring  device  in  the  cryogenic  region  because 
its  dR/dT  is  so  large,  and  its  resistance  at  a  temperature 
approaching  absolute  zero  (0  Kelvin)  is  so  great.   However, 
solid  state  physicists  have  utilized  the  idea  of  mixing  two 
or  more  elements  to  form  an  alloy  which  would  reduce  both 
the  near  zero  Kelvin  resistance  and  the  sensitivity  to 
dR/dT.   Impurities  are  commonly  introduced  into  germanium  in 
the  form  of  pure  elements.   Some  -of  these  elements  include 
phosphorus,  gallium,  and  arsenic. 


-  153  - 

D.    Noble  Metal  Thermocouples 

1.  Environmental  Stability 

Darling  and  Selman    '    conducted  a  series  of 
experiments  in  which  the  environmental  stability  of 
noble  metal  thermocouples  v/as  investigated  in  a  system- 
atic manner.   In  particular,  they  studied  the  compati- 
bility of  the  platinum  metals  with  oxides  such  as 
alumina,  magnesia,  zirconia,  and  silica.   Their  experi- 
mental results  indicated  that  the  reactions  between 
platinum  and  the  refractory  oxides  are  controlled  by 
the  affinity  of  platinum  for  the  metal  released  on 
decomposition,  by  the  surface  area  of  the  reacting 
substances,  and  by  the  rate  at  which  oxygen  and  metal 
vapors  can  be  removed  from  the  reaction  zone. 

2.  Chemical  Reaction 

Metal  oxide  decomposition  involves  a  process 
of  dissociation  which  yields  both  metal  and  oxygen  in 
gaseous  form.   In  the  case  of  aluminium,  the  reaction 
can  be  described  as  follows: 

2/3  Al2  03  *~     4/3  Al  +  02 

Alumina  dissociates,  oxygen  is  evolved,  and  platinum 
extracts  metal  from  the  refractory  to  form  dilute 
alloys.   Experimental  data  confirmed  that  platinum  has 
a  much  higher  affinity  for  zirconia  and  alumina  than 
for  magnesia.   One  proposed  postulate  to  explain  this 
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phenomenon  is  that  the  magnesium-magnesia  dissociation 
pressure  is  higher  than  the  vapor  pressure  of  platinum, 
whereas  the  metallic  vapor  pressures  of  zirconium  and 
aluminum  lie  well  below  that  of  platinum.   Most  of  the 
reaction  processes  occur  through  a  vapor  phase  and 
proceed  rapidly  only  when  oxygen  is  continuously  removed 
from  the  reaction  zone. 

E.    Variable  Resistance  Pressure  Transducers 

A  diagram  that  illustrates  the  basic  operating 
principle  of  the  variable  resistance  pressure  transducer 
is  shown  in  Fig.  2.   The  pressure  to  be  measured  is  applied 
to  the  force  collector  (capsule)  which,  through  a  linkage 
rod,  moves  a  sliding  contact  (wiper)  across  the  electrical 
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Fig.  2  Potentiometric  Pressure  Transducer  Schematic 
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resistance  wire  windings.   This  action  in  turn  produces  a 
resistance  change  between  the  wiper  signal  lead  and  an 
excitation  lead.   Therefore,  with  the  wire  excited  as  shown, 
a  voltage  change  between  the  wiper  and  excitation  lead  can 
be  developed.   This  change  is  linear  for  most  transducer 
designs.   A  nominal  full-scale  deflection  for  such  a  system 
is  about  two  percent  of  the  capsule  diameter.   In  order  to 
obtain  large  deflections,  two  or  more  capsules  may  be 
cascaded  so  as  to  add  the  deflections  of  each. 

Besides  using  a  capsule,  a  bourdon  tube  can  also  be 
used  as  a  force  collector.   The  bourdon  tube  is  a  spring 
alloy  tube  with  an  elliptical  cross  section  which  is  closed 
at  one  end  and  is  shaped  in  a  curved  or  twisted  configuration, 
When  pressure  is  admitted  into  the  tube,  the  difference  in 
area  exposed  to  the  pressure  causes  the  curved  tube  to  tend 
to  straighten.   Thus,  if  the  open  end  is  held  securely,  the 
closed  end  will  move.   The  bourdon  tubes  can  generally 
provide  greater  deflections  than  capsules.   Many  transducer 
designs  incorporate  the  spiral,  helical,  and  C-shaped 
bourdon  tubes  because  of  their  large  deflections  which  in 
some  cases  permit  transducers  to  be  built  without  an  extra 
linkage  between  the  tube  and  the  resistance  element.   This 
minimizes  vibration,  friction,  and  backlash  problems. 

The  resistance  element  of  a  potentiometric  transducer 
most  frequently  consists  of  electrical  wire  wound  on  a 
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mandrel.   The  wire  is  generally  a  platinum  alloy  on  the  order 
of  0.001  -  in  diameter,  whereas  the  mandrel  is  an  insulating 
material  such  as  ceramic  or  phenolic. 

F.    Strain-Gage  Pressure  Transducers 

Most  strain-gage  pressure  transducers  have  a 
configuration  like  that  shown  in  Fig.  3.   This  is  the  so- 
called  bonded  strain-gage  technique  that  consists  of  four 
active  strain-gage  elements  bonded  to  the  elastic  element 
(cantilever).   When  a  force  is  applied  as  shown,  the  two 
top  strain  gages  (1  and  2)  are  in  tension  and  increase  in 
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Fig.  3   Bonded  Strain-Gage 

Cantilever  Transducer 


resistance  while  the  bottom  elements  (3  and  4)  are  in 
compression  and  decrease  in  resistance.   By  connecting  the 
two  elements  whose  resistance  increases  (1  and  2)  and  the 
two  whose  resistance  decreases  (3  and  4)  in  diagonally 
opposite  arms  of  a  bridge  as  shown  in  Fig.  4,  maximum 
output  is  obtained. 
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Electrical  Connection 


In  recent  years,  however,  with  the  advent  of  semi- 
conductor technology,  it  has  become  advantageous  to  manu- 
facture strain  gages  from  semiconductor  materials.   The 
semiconductor  gages  have  a  gage  factor  that  is  approximately 
75  times  greater  than  that  of  a  wire  gage.   Gage  factor  is 
defined  as  the  ratio  of  normalized  resistance  change  to 
unit  change  of  strain.   With  a  substantially  higher  gage 
factor,  manufacturers  are  now  able  to  develop  smaller  and 
extremely  stiff  pressure  sensors,  allowing  high  frequency 
dynamic  measurements  to  be  made  more  conveniently  and  more 
accurately. 

Besides  the  more  familiar  bonded  metal  wire  strain-gage 
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configuration,  there  are  several  other  types  of  strain-gages; 
some  of  the  examples  are  gaged  diaphragm  pressure  transducers, 
cantilever- type  transducers,  pressure  vessel  transducers,  and 
unbonded  strain-gage  pressure  transducers. 

G.    Diaphragm-Type  Variable  Reluctance  Transducers 

A  variable  reluctance  pressure  transducer  commonly 
used  in  the  pov/er  industry  employs  a  diaphragm  as  the 
elastic  element  and  is  shown  in  simplified  form  in  Fig.  5. 
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Fig.  5   Diaphragm-Type  Variable  Reluctance 
Pressure  Transducer 


A  diaphragm  of  magnetic  material,  supported  between  two 
inductance  core  assemblies,  completes  a  magnetic  circuit 
with  the  cores.   The  diaphragm  deflects  when  a  differential 
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pressure  is  applied  to  the  pressure  ports.   This  increases 
the  air  gap  in  the  magnetic  flux  path  of  one  core  while 
decreasing  the  gap  in  the  other;  therefore,  the  reluctance 
of  each  flux  path  is  altered.   The  overall  effect  is  a 
decrease  in  inductance  of  one  of  the  wire  wound  coils  and 
an  increase  in  the  other.   A  half-bridge,  two-active-arm 
device  is  formed  if  the  two  coils  are  connected  as  shown 
in  Fig.  6. 
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Fig.  6   Electrical  Configuration 
for  Variable  Reluctance 
Pressure  Transducer 


H.    Piezoelectric  Pressure  Transducers 

Most  piezoelectric  elements  will  reach  a  Curie 
point  when  heated.  At  this  Curie  point  temperature,  the 
crystalline  structure  changes,  polarization  is  lost,  and 
hence  the  piezoelectric  effect  is  destroyed.  Quartz  has 
a  Curie  point  of  approximately  1000  F,  whereas  this  temp- 
erature for  some  of  the  ceramic  elements  is  as  low  as 
250  F.   In  addition,  quartz  has  a  negligible  pyroelectric 
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effect  which  is  defined  as  the  changes  in  output  that  are 
proportional  to  the  change  in  temperature  experienced  by  the 
crystal.   It  is  for  these  two  reasons  mentioned  above  that 
the  quartz  element  is  particularly  more  applicable  in  areas 
of  temperature  change  and  high  operating  temperatures. 

Ceramic  elements,  on  the  other  hand,  have  a  charge 
density  that  is  generally  10  to  100  times  greater  than 
that  for  quartz;  as  a  result,  ceramic  elements  are  often 
used  in  situations  where  low  pressures  are  measured. 
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